General
-
Target
OQPO4500150211Rev0.PDF.rar
-
Size
217KB
-
Sample
210715-mgm56px616
-
MD5
612c0186f738761f5e96f4e82630d8c3
-
SHA1
c55225781949e1b21b189afff394bb2bcf9e1c7d
-
SHA256
c8f855e252fa23eb154ab80a393b574e2cde69a5401d0a17681af87d9a7b2174
-
SHA512
3dfe49d1ad2ac13bb5b87800be87dbd8cdd1c46d563a6aa3e1ebd83de6694b2986baa5629c20e391818ed01f56b6f8dee0f2e4e759253d48c6fbc1046045cb0a
Static task
static1
Behavioral task
behavioral1
Sample
OQPO4500150211Rev0.PDF.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
OQPO4500150211Rev0.PDF.exe
Resource
win10v20210408
Malware Config
Extracted
warzonerat
blacice24.hopto.org:5032
Targets
-
-
Target
OQPO4500150211Rev0.PDF.exe
-
Size
529KB
-
MD5
f6b25b3de51b2a8bdfbbd795c9f21e9e
-
SHA1
8138784d3e0bfa23175e3e90d499e3fa8733e79e
-
SHA256
9a2cb3f989deb6155e1cc129c68a31b678940db7a477c60bb0ea2d4d88aa22bc
-
SHA512
328915066292ceeab06b925f8e93861ce9bf7118b0e15228ed6440291a5bfef92292694f56ac958a72beccd4f1c07a795023da527dffdced1c419c94b9d175fd
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Loads dropped DLL
-
Adds Run key to start application
-