Extracted

• • Target

    2ec00ca69481fd347a905dd8d7a426f2_JaffaCakes118

  • Size

    1.0MB

  • MD5

    2ec00ca69481fd347a905dd8d7a426f2

  • SHA1

    ffcdb939d1cdf725f8841c0fcabb0ed350fb3380

  • SHA256

    e9306553fc49cf5964b3677986d125dbddad79546bdd37ba7dd9cf975b5976d1

  • SHA512

    39c9328d3237b003453b20d4da0eb3d509016b8860378361cda362db073ab4209e5bd442c58025354d05e97c2a8054c7ec5908ddb02a33e1c8c6aeea55f6f1c2

  • SSDEEP

    12288:52nSFt1CG2QHdFc/i1VHK+sTUIXwn1QN7KUl58HK7zPI:QnSFtkG2QHw/CK+sTU1mTl5rM

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2