General
-
Target
feo.exe
-
Size
704KB
-
Sample
210528-z6y8fpynle
-
MD5
bc3c20b25e79e6ed82ba7ab84934067d
-
SHA1
5a18f78cf60c527c60a8b6f67c9857bdf4426be8
-
SHA256
b5633b89bc09a7e0bfdb617572df279f2a08518ffe186ad3c372f2b53c210996
-
SHA512
5b1d28f733c6e51a1c1cf6eb25e08cf0a53c64bb91fa730732b6fb7fe1a63b6ec370044fe6eb55c48982b5b1ed1a8a4ddd33e69eb2ab6b54f92ae400b326c7da
Static task
static1
Behavioral task
behavioral1
Sample
feo.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
feo.exe
Resource
win10v20210410
Malware Config
Extracted
warzonerat
adebaree.duckdns.org:9145
Targets
-
-
Target
feo.exe
-
Size
704KB
-
MD5
bc3c20b25e79e6ed82ba7ab84934067d
-
SHA1
5a18f78cf60c527c60a8b6f67c9857bdf4426be8
-
SHA256
b5633b89bc09a7e0bfdb617572df279f2a08518ffe186ad3c372f2b53c210996
-
SHA512
5b1d28f733c6e51a1c1cf6eb25e08cf0a53c64bb91fa730732b6fb7fe1a63b6ec370044fe6eb55c48982b5b1ed1a8a4ddd33e69eb2ab6b54f92ae400b326c7da
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Loads dropped DLL
-
Adds Run key to start application
-