Extracted

• • Target

    JaffaCakes118_94b3f60ce09e1ce59051c6ac3c0910ef

  • Size

    401KB

  • MD5

    94b3f60ce09e1ce59051c6ac3c0910ef

  • SHA1

    b4e4198ee0cc4846a4ef975c2daf62f3ff61b155

  • SHA256

    c59eb6d8ac6774b7a93140189e773bed9c57a8c2a42996b72ccd06c543dc678b

  • SHA512

    4299432cdf56bc96b6e80e5472c51a596676a568dfee64bf538cc7132b9004ed8e7b08dc241e0c6e85df022579441341679853475cbf6eb5c64e10faa4f8b567

  • SSDEEP

    6144:+yLuIbiO66amhdTkgtym01Kci1eeicdryGWc1Zxl8ZTZrU012+saG:s/k7NEm0b6MKec1rlEu1aG

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • Modifies WinLogon for persistence

    persistence

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2