Extracted

• • Target

    7de510534f43be1b2b7d2798c373ab14_JaffaCakes118

  • Size

    1004KB

  • MD5

    7de510534f43be1b2b7d2798c373ab14

  • SHA1

    93af0322cbde3aa0095126cfefa4574c653eb6f9

  • SHA256

    57276e70c44185910dfb1c298b8508f2a172e40df2fdb5322fb711668948642d

  • SHA512

    7ae46008b893163e9b8815c324f703d1e2571f4ca98e298e6bf5d8dcfe5d85c8c7cbcf3b1c970e1b8eca5e6fd030da7e736003c5115687ceb2924441d19f1b0e

  • SSDEEP

    24576:Tlb0wFVMNjDvBJ0fRH3SKiXnZWMwiVngfGw:TlYwFShDvBJ413lYZn/Fgj

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2