Extracted

• • Target

    JaffaCakes118_a2eb80e1eb95fcae31d25d45f8aac5c4

  • Size

    430KB

  • MD5

    a2eb80e1eb95fcae31d25d45f8aac5c4

  • SHA1

    36dee0f11d459954546262ad1df0fe3975862535

  • SHA256

    4a625f731812b745da181f18182b3e9c2a212e14b1aad9b82fb347a0eabc7f27

  • SHA512

    79a584804355578fed29136756e20085581e0cc9bd3b4110372f22341729be0a09b04fb8cbe9392866b01b3e7146b62ce133787f5ff56788aced9a0c53adf247

  • SSDEEP

    12288:Lq+eBVvFqJFTPMHggk1l3EA6mVuRRvTFnpWaCr:xkvFq01E/6mKvTJ7Cr

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2