Extracted

• • Target

    JaffaCakes118_32211dee6a6c7e4850368408ab5ebc2a

  • Size

    2.2MB

  • MD5

    32211dee6a6c7e4850368408ab5ebc2a

  • SHA1

    77125dae47e851d11a8865b7dbf3e4aeb6086342

  • SHA256

    6e39e977c4fc8fe87ac857a349fdeaf40873cb296e46ca715a223fdf012b0143

  • SHA512

    7acd8b95f5268cb780078d61216207e878182e89f600cd8c7eea9e8645244a96d533ce4425ac810319be5bd995d5aedcd47c89719abcef9a36131fd3227d3a5f

  • SSDEEP

    12288:axYXuBiUvOTi2TJlDrnDrnDrnDrnJrlxtGfaIJ2Lk1VwtVr06Mv+vsBwSjfwD90e:WYG2TJljIJzozJzdbanoqKBXP

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2