Extracted

• • Target

    JaffaCakes118_3640b9da89871f72a86d8aac0558e5e4

  • Size

    901KB

  • MD5

    3640b9da89871f72a86d8aac0558e5e4

  • SHA1

    5d9620e919446a5ab9ed8b1d3ff1fb29790c1dfe

  • SHA256

    3cef21b3cacd18eb48c6b2d3d517aa2891a132c2a4bd51fc06d9936abdbc144e

  • SHA512

    956ca0fe1baa0d9febe1f56d9c0395fdd22212e0cbf5eb8d81a845b06bec683ad3e57f7be65ac71487dd92265b93de0cc6c15f6d07b46c5b7d24787cd18e948d

  • SSDEEP

    24576:XAHnh+eWsN3skA4RV1Hom2KXMmHackv5:Kh+ZkldoPK8Yac4

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2