Extracted

• • Target

    b50fea4606274bedc8d82dfdb050894e_JaffaCakes118

  • Size

    892KB

  • MD5

    b50fea4606274bedc8d82dfdb050894e

  • SHA1

    3fbc9e317c1d373fa02e0c6ec4b615f334e3104c

  • SHA256

    df51d17576e6b5ff7488221079a6d0beb42cebf347c7ea04f4b07f2188863a16

  • SHA512

    fdfbd571b5c018b0b50ae025e59069f2e5b708af53c4df5e888328c0d7d0d4d70c8e8a3f8b5be708a49ec3bfa6d6a37dd2c0e932980c849e95ba17a233c3d95a

  • SSDEEP

    24576:IzbGHAzHAjX1VcLg5KzdcXDq3oKLGIua:IziHILEgzdIeYKSa

  Score

  10^/10

  discoverywarzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2