Extracted

• • Target

    JaffaCakes118_415fa2ac98a43375fc189e6e0eed93bd

  • Size

    544KB

  • MD5

    415fa2ac98a43375fc189e6e0eed93bd

  • SHA1

    feb7b0753ea02d37169471f692cb80790824b733

  • SHA256

    d9cc6ee14d2ce752d8cd3f505e725a53f292622e2cf15077afdf5845311d31e9

  • SHA512

    3e48a65acd9ba707868594455d6f6dacec5126625682a9c484dfe0cea64d048f836a6f6139298d4dd9714ce8337d0e693837e525e33996045643d8462d207b7a

  • SSDEEP

    6144:F6Uqd2GhNHAQHXcqUSheJ3xWEAnISvWM+/VxjnXGIbfE4hxqTnsZv:8Ui2iNgUXcdSAFAjvWHGIrZpZv

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2