Extracted

• • Target

    c46a2af1bddbb0eca275e471a8b97bd3_JaffaCakes118

  • Size

    990KB

  • MD5

    c46a2af1bddbb0eca275e471a8b97bd3

  • SHA1

    03503ee5df73a99678c517dcaf658b5112d50185

  • SHA256

    160e446ae73cb863d4b03ae61fc19412c40ff3c54801fee7688717869c782dd1

  • SHA512

    5ba6854d8f6562a6bf4cf8632109a85f8d9246a48fdf571e7f0d472c98d09350bf37e327ba3fd296da88bdc5a7ab518bee0cffb9893b2fd5c566f63e9ea25e72

  • SSDEEP

    24576:qAOcZuXPw5FUAD5JQfBo8qzPq3XFQYcqa6lCKCz:QeF3QazPWX6Kta

  Score

  10^/10

  bazaloaderwarzoneratdiscoveryinfostealerpersistencerattrojan

  • Bazaloader family

    bazaloader

  • Detects BazaLoader malware

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests - JaffaCakes118.

    trojan

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2