Extracted

• • Target
    JaffaCakes118_0e8c864d5638af801a728e904764e7b4
  • Size 476KB
  • SHA256 9606e674674fb6ad3cf90d820b43c43ce7cbf7d066f3228c0d794091be573b4c
  • MD5 0e8c864d5638af801a728e904764e7b4
  • SHA1 b68836f88d48abe796c403a0b27cdfc221c1587c
  • SHA512 e2bd244cc18db09c95a1225c8c3cc73e53ebe0b212fc29a563c2bb274d1e011a5bc14ed7fc9dcc3209b7bc8b9eca5ef4d26386d7f42a42acc33115d2540a9ef1
  • SSDEEP 12288:bl4MLda0aomYEzHs1FmcAp/HEzPgLaw9:59Z/ys1XAHEzPgP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bazaloaderwarzoneratdiscoveryexecutioninfostealerrattrojan

  • Bazaloader family

    bazaloader

  • Detects BazaLoader malware

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests - JaffaCakes118.

    trojan

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1