Extracted

• • Target

    a573ef25c8d221c08da23a2b132508f0_JaffaCakes118

  • Size

    1.2MB

  • MD5

    a573ef25c8d221c08da23a2b132508f0

  • SHA1

    3edad04e6b7740e05964059d8ceb4bf2c2c456e0

  • SHA256

    39431170eaed8f62c5094274c51f7cfaba8f1aaa1b184ba344c3dc3a12ba00a5

  • SHA512

    ad34d9a3eee4bdd523ac9303bca9621e183d8d084f29df2f421bb236d95d4ec056add2a67ec8fd060170c5bc5ca4b29677dd885cb3757faa99149b7739d9da8f

  • SSDEEP

    24576:kdjs1++n4k5/d31S4Jzqx260A+o3JaL6QtPIFn:kFyzS4Jzy26F+o5xEO

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2