General
-
Target
10b.zip
-
Size
639KB
-
Sample
210524-56qdvx29ha
-
MD5
571ebed5abb3a91ca36de366f77cc888
-
SHA1
ec6764b5d61d2788a720ade51a72bb8f2cda9d68
-
SHA256
9b4055863b5fddea27dac8436cb4561c182c2ae4662780615eb3079a67011bcf
-
SHA512
a3b09efe314b073125e44744a66cadabf7268757a146ebf45b3d2a5b7d24ea74932d2ae9d28d8b69816a39dba7d791919151e3fedcbf472152c1d8eb36c9ee45
Static task
static1
Behavioral task
behavioral1
Sample
d80ef3539826be2df8fc985eada5f191b3ae9eb9eb53dfbb054651d25daafe23.bin.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
d80ef3539826be2df8fc985eada5f191b3ae9eb9eb53dfbb054651d25daafe23.bin.exe
Resource
win10v20210410
Malware Config
Extracted
warzonerat
157.55.136.23:5300
Targets
-
-
Target
d80ef3539826be2df8fc985eada5f191b3ae9eb9eb53dfbb054651d25daafe23.bin
-
Size
946KB
-
MD5
9ff1b2088f56e257a002e806a181a3b8
-
SHA1
af0ac66cf6c48c7b8429acb8053f99160eea5c8c
-
SHA256
d80ef3539826be2df8fc985eada5f191b3ae9eb9eb53dfbb054651d25daafe23
-
SHA512
fe1b9266eca9168462ac4904f5ebda1c8830340a1b1f23066f715616ed2c5fcd472efb0214c95de14b13f5f8180ddfd7edfb24a2e16fde6101c834c93c9ea75e
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Suspicious use of SetThreadContext
-