Extracted

• • Target

    474da6264953fb83a0c7ebf5ef12d724_JaffaCakes118

  • Size

    2.6MB

  • MD5

    474da6264953fb83a0c7ebf5ef12d724

  • SHA1

    cf9a46bb6daae05eeec53116f53fc44bdf5d810d

  • SHA256

    a9321317116649103debb8a03f5b36ee8b015fa48fc7da5c2b5eb5192dac8233

  • SHA512

    4f4567699a93859f0b0ab36321e97c5dc05cd764f069430d65121d11287dd630433871f579c30524db03a63b791bd2431d3de0540c9f7dc6a4d17645b096fb87

  • SSDEEP

    12288:QD4a0FisqocEgMHv4FiiEuu5VfCgWLdd7FPza6qfKwZMsudkM0D4pa7+os:hrd/WLdd7FPzkfKugdkML

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2