Extracted

• • Target

    JaffaCakes118_59bb4d143a763b301716ae82c4c2246a

  • Size

    3.2MB

  • MD5

    59bb4d143a763b301716ae82c4c2246a

  • SHA1

    a3bf1ea3fb3c5ae9b9963f85f5359094be35fe3f

  • SHA256

    71009577073b8bb81aa03ae1297593944de423e05066062fcb24bbfa2ed8f891

  • SHA512

    eb3092f9389547b61b97638320bd0d2184304c0d82fd8e5ad06737cd51a8000d5b4ca02b4ac2046b1878659c119ac923a9943b620d23d0219c405a652479411a

  • SSDEEP

    49152:acbBt7vOyJ6znU1CAWhwEFAjog1+sLD+pwU0+1baZKnzg:a6B9v1YznUgAWhwEEr1+KLU0+1baN

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2