General
-
Target
Magaza_opis oferty produktowej_SKCMGCCdoc.exe
-
Size
35KB
-
Sample
210630-nyghvp2l2n
-
MD5
b455358185501ce270f622fa64e60560
-
SHA1
eb11fece160cc11255541d42ef89c42657cdef67
-
SHA256
85c02d0cd6412118420143865d77fc24fdc9fcddae292155919aad1270d327ca
-
SHA512
d7c4c1a0140cddd169e0325c046238dadf253452bac5789f6612d2eb0fb454f0ddefd8ec247b3e5ecf9063f9694e4c70449a9b98243e50ccc14fd22fd809f4e5
Static task
static1
Behavioral task
behavioral1
Sample
Magaza_opis oferty produktowej_SKCMGCCdoc.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Magaza_opis oferty produktowej_SKCMGCCdoc.exe
Resource
win10v20210408
Malware Config
Extracted
warzonerat
178.170.138.163:4554
Targets
-
-
Target
Magaza_opis oferty produktowej_SKCMGCCdoc.exe
-
Size
35KB
-
MD5
b455358185501ce270f622fa64e60560
-
SHA1
eb11fece160cc11255541d42ef89c42657cdef67
-
SHA256
85c02d0cd6412118420143865d77fc24fdc9fcddae292155919aad1270d327ca
-
SHA512
d7c4c1a0140cddd169e0325c046238dadf253452bac5789f6612d2eb0fb454f0ddefd8ec247b3e5ecf9063f9694e4c70449a9b98243e50ccc14fd22fd809f4e5
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Drops startup file
-
Suspicious use of SetThreadContext
-