Extracted

• • Target

    9ac604ab0f70a0d75f107b8f52d97000_JaffaCakes118

  • Size

    1.4MB

  • MD5

    9ac604ab0f70a0d75f107b8f52d97000

  • SHA1

    48bfbec3b38f5070419e63efce548e7a234a3f0c

  • SHA256

    46dff1fda981f377a8ae116f14a7a4352e373787186606d2c5a91ae0c6c25609

  • SHA512

    5abea1a5274fd72fc64a44f3aea3545e4b5ab3e2d261c399ff40495f42fc59089756f832f1f0fa408e8714f76a710d2d616017193b53ba074172498e722bcd73

  • SSDEEP

    24576:V/CqsL1yQdGc9O42AT2fXB52MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMMMMMX:icAGc9O42AT2/KMMMMMMMMMMMuMMMMML

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2