Extracted

• • Target

    JaffaCakes118_340c89b2f53261125d86d2289fd65456

  • Size

    1.3MB

  • MD5

    340c89b2f53261125d86d2289fd65456

  • SHA1

    4cf8364eeb744304775a3037da631c6b0cffa19a

  • SHA256

    f25660daa72c172425bc14dd48d5aaa52fd87b6babecc911e12b39b5e51954d0

  • SHA512

    165faf95ae82cccdbf3eb47def07953f17fbe11c85c2db2db12b87cc02d1b515d9f2d5c3c276c149206b7f5eef72058aaa2c95d70ac57a658790d0d350b13444

  • SSDEEP

    6144:DuW80WhmQDzYm00RiTwSltgxCKYPMXq9NmiQBYGhpX8x4MWy1FYCz8hJ2n3C+8JD:DuWoJ4D4pa7+o4H

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2