General
-
Target
Leaked sex Tape MT Govt -copy- JPEG.exe
-
Size
296KB
-
Sample
210114-jthf26yqts
-
MD5
364e06fdc0046cc32b4a524d5aaf5a45
-
SHA1
7655db23b8887da6da8c5be7f3378ac715afcb2b
-
SHA256
cf6fc4b3a468d55d129b5289cde3faa6221f5ff683cd044822764e974b75fbd0
-
SHA512
eab4b6c9dae3b8d69d71d97c8b86665e34d2fef1c2edf30b05b09bd7a545b35ee405a36195c0c510d670f9b4533e921056649747ee2d3f2c02f7d07eee907f20
Static task
static1
Behavioral task
behavioral1
Sample
Leaked sex Tape MT Govt -copy- JPEG.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Leaked sex Tape MT Govt -copy- JPEG.exe
Resource
win10v20201028
Malware Config
Extracted
warzonerat
dompe.awsmppl.com:4050
Targets
-
-
Target
Leaked sex Tape MT Govt -copy- JPEG.exe
-
Size
296KB
-
MD5
364e06fdc0046cc32b4a524d5aaf5a45
-
SHA1
7655db23b8887da6da8c5be7f3378ac715afcb2b
-
SHA256
cf6fc4b3a468d55d129b5289cde3faa6221f5ff683cd044822764e974b75fbd0
-
SHA512
eab4b6c9dae3b8d69d71d97c8b86665e34d2fef1c2edf30b05b09bd7a545b35ee405a36195c0c510d670f9b4533e921056649747ee2d3f2c02f7d07eee907f20
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Drops startup file
-
Suspicious use of SetThreadContext
-