Extracted

• • Target

    a6123e1e92c6ea08908865bb63fbf249_JaffaCakes118

  • Size

    1.0MB

  • MD5

    a6123e1e92c6ea08908865bb63fbf249

  • SHA1

    f500aaa9d535ebdd0a9d3766d1a86b0a1ff08891

  • SHA256

    7cec042f22812fade5b8fbfe213a8e70626dc8faf1eee7d40d51213882d9b779

  • SHA512

    5bfd3fa437bb79ba3d21baa6f73b6b13d61cf64f66402074f8119dc31a3cf51d09ddd00886010fa02cb949b4347a2225d0f793f8fc850738ed0beafeb4505320

  • SSDEEP

    12288:6Yg8ZoaCNhQgXp1VtZ0Bq2Q0JyaAP9JNSekJyMAFWL+GkpmzF+Vn0hnVMh:6sxFgXp1VMq2lyz1uePFW

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2