Extracted

• • Target

    d34aaeb4974f48c1f239e7cefd28e1b6_JaffaCakes118

  • Size

    1.1MB

  • MD5

    d34aaeb4974f48c1f239e7cefd28e1b6

  • SHA1

    2722a0666ab09d4f9220c327553d5a60d02356da

  • SHA256

    85fd6ce192054a81246927f2337c687187b518225239f80c462fbb998a52f81c

  • SHA512

    7bf7e5d148b81f8c8e8ffe43b91b6d3862c2e43f0c04586f4d683db6e57464a19892c3e1a2c5b221b5bcc89f822820db3e0d0265ffbd00f6dbb2b7293529dd83

  • SSDEEP

    12288:0c/5tE7w6ukIelmxcmjK1FnPI8W3qMolwn6w2HlkRMGrmQ/X/mgQkjm/HL0uPFdQ:NW7w6ulAqxW+yyxtrmQ/X/Kkjm/HL0L

  Score

  10^/10

  discoverywarzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2