Extracted

• • Target

    552f655b4aed1ec608faeffa09c9aa01_JaffaCakes118

  • Size

    1.4MB

  • MD5

    552f655b4aed1ec608faeffa09c9aa01

  • SHA1

    fffcfee5937dca71e22959b62bee71e0b69ca93f

  • SHA256

    fa5cc57d4cb1d528a7840bb918f0f3f8d0e2cc9340952da225380dbec45d4754

  • SHA512

    557060d408d5fd176455f8e07807e56541edab0352f1aa71ad361603a93bff441060446f4c6182171e21bfea275fad3771def36b64e20f11df220ce58d086fed

  • SSDEEP

    12288:GEbmLEJeiRshCg8j5snE7mUCBcmN4lhaKp0WByDSPCjT54kQ6H+Uy1Susr8MmH3R:mYJeSshcVgE0B3uMWBywQKZZS5R0

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2