Extracted

• • Target

    e8c492551db90d4a0fb448afcc829d0b_JaffaCakes118

  • Size

    622KB

  • MD5

    e8c492551db90d4a0fb448afcc829d0b

  • SHA1

    228d222620262a8bcd982321fe900074d28bc5e4

  • SHA256

    36ce2a91dc933eb6146e07e09147be9f86b736fd97d01bd5d7b9fccbedbb7d70

  • SHA512

    d010d9277724a2761098214bc55a10b8e0837072e8aa7b7a0530e554d603c8598afc2046c0c97082d40846550ab7e31a7110ea0d017d0e9b89ee3c8f53ab0ecb

  • SSDEEP

    12288:TJf/HK7zwCSHTB/9Hjsd99qJz2jwJ3ehRsoEj9woVifaEQeAB5Ya:4dSHTrHwUp2W4RsoEpIaEQecW

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2