General
-
Target
b214cee84b16aeb61636a83879b2fc9a
-
Size
412KB
-
Sample
210709-asfsmfp4ye
-
MD5
b214cee84b16aeb61636a83879b2fc9a
-
SHA1
b496aef57c8b1712c7e16abb098c20d544e2c639
-
SHA256
808471efa1f93a3e6a70c762b8e6d980258c40bb3a6f6aacb08486e64e1ae18f
-
SHA512
cb3999ed5bfc7164770fbf34d947154a124dedaef59f95d543b0a3ec6d3f9063bbacb94650564f78158e05b3b0cee5e99770970c909a3f29ab924ccd46c1fe67
Static task
static1
Behavioral task
behavioral1
Sample
b214cee84b16aeb61636a83879b2fc9a.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
b214cee84b16aeb61636a83879b2fc9a.exe
Resource
win10v20210408
Malware Config
Extracted
warzonerat
147.124.213.132:5200
Targets
-
-
Target
b214cee84b16aeb61636a83879b2fc9a
-
Size
412KB
-
MD5
b214cee84b16aeb61636a83879b2fc9a
-
SHA1
b496aef57c8b1712c7e16abb098c20d544e2c639
-
SHA256
808471efa1f93a3e6a70c762b8e6d980258c40bb3a6f6aacb08486e64e1ae18f
-
SHA512
cb3999ed5bfc7164770fbf34d947154a124dedaef59f95d543b0a3ec6d3f9063bbacb94650564f78158e05b3b0cee5e99770970c909a3f29ab924ccd46c1fe67
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Suspicious use of SetThreadContext
-