Extracted

• • Target

    JaffaCakes118_ea132fbed0da2723d47ec17a9576b9bb

  • Size

    474KB

  • MD5

    ea132fbed0da2723d47ec17a9576b9bb

  • SHA1

    a882706fdde2531a17268ac5bc712d77ec47b5ef

  • SHA256

    ee1e67b70efdd4e22c534e9f3575036db9963f9b5ad4a8b0a4d4c26d45fea155

  • SHA512

    7a315512e04eb42789985d97904c36f2f337581b2599a14c398e7bbab615eb6d40c00c30b32b9b3c1f426a3ec8b43dab341f50a4c846ba66e6cb9621573ffdc5

  • SSDEEP

    12288:J8SIbw8eGrT3jSrmLdyHcrfokLSN0hGbpqJFTP:JEbw8eGrTTjZy8rAoSN0EFq

  Score

  10^/10

  warzoneratdiscoveryevasioninfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Warzone RAT payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2