General
-
Target
b6bd7e3441e81b784e91079392abd5ec.exe
-
Size
680KB
-
Sample
210627-2cwrw49n4n
-
MD5
b6bd7e3441e81b784e91079392abd5ec
-
SHA1
18845b925092aade6be7013cd169e110c1ec80fc
-
SHA256
555a20d3756ad65f74f4ea768098c703a14bdb667772223abb8ea6e1c084ee7c
-
SHA512
64a3df2fbc5d3da2e1e0e3b26921dd603e17f8de6e39bfb9648166af9b19d400c382a89a3ba74d9ffd0566025f0aba6c16a0732535168fc24e78762835270a6a
Static task
static1
Behavioral task
behavioral1
Sample
b6bd7e3441e81b784e91079392abd5ec.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
b6bd7e3441e81b784e91079392abd5ec.exe
Resource
win10v20210410
Malware Config
Extracted
warzonerat
seencroundercontroller.webredirect.org:1894
Targets
-
-
Target
b6bd7e3441e81b784e91079392abd5ec.exe
-
Size
680KB
-
MD5
b6bd7e3441e81b784e91079392abd5ec
-
SHA1
18845b925092aade6be7013cd169e110c1ec80fc
-
SHA256
555a20d3756ad65f74f4ea768098c703a14bdb667772223abb8ea6e1c084ee7c
-
SHA512
64a3df2fbc5d3da2e1e0e3b26921dd603e17f8de6e39bfb9648166af9b19d400c382a89a3ba74d9ffd0566025f0aba6c16a0732535168fc24e78762835270a6a
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Suspicious use of SetThreadContext
-