Extracted

• • Target

    JaffaCakes118_577a4f4a604b0a05da9ec1781fd5894f

  • Size

    821KB

  • MD5

    577a4f4a604b0a05da9ec1781fd5894f

  • SHA1

    6117b837be45aed2122d1ef9e7dd6d9f3eaadadd

  • SHA256

    26b85e1456b150775c4d4a77a57be2e99ac5429998184c8a576adef665e9ac72

  • SHA512

    8f0f4dbe1520b6494754bceac6c16ea0a213bb91882eb76f012fdc3aeaffa4dd4d513272dff9356d950bbad0d0165c4ac0abaff1a99ded4692eb35c1123bc185

  • SSDEEP

    12288:FTdFMzKtqbAPRI/k6eLUuQyK1Q1l3uxOhxl0Ab6lgrdm4Vz0RppppppppppppppP:FTdFMAQAJIs6eLtm61l3uAxlW

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2