General
-
Target
DHL_Jul 2021 at 1.7553BZ290_PDF.exe
-
Size
1012KB
-
Sample
210715-vb6pyzm1ce
-
MD5
c2df38da028057224b6cdf75dc908656
-
SHA1
d8496905a1687bf08dc616384fd99f816e999268
-
SHA256
0b731f9563887bc9ba8a88f6b7bf8b6aea379e24d521ff5572bc9c287ab68d00
-
SHA512
9c42edcf1ffc5e5f4eca45cca8d78ed6a2422417e69479d5429a727864bd015328a98c36c83807658eb4dce45188af145705fa546e4d1de745428f6b01dfd423
Static task
static1
Behavioral task
behavioral1
Sample
DHL_Jul 2021 at 1.7553BZ290_PDF.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
DHL_Jul 2021 at 1.7553BZ290_PDF.exe
Resource
win10v20210408
Malware Config
Extracted
warzonerat
103.133.109.176:7600
Targets
-
-
Target
DHL_Jul 2021 at 1.7553BZ290_PDF.exe
-
Size
1012KB
-
MD5
c2df38da028057224b6cdf75dc908656
-
SHA1
d8496905a1687bf08dc616384fd99f816e999268
-
SHA256
0b731f9563887bc9ba8a88f6b7bf8b6aea379e24d521ff5572bc9c287ab68d00
-
SHA512
9c42edcf1ffc5e5f4eca45cca8d78ed6a2422417e69479d5429a727864bd015328a98c36c83807658eb4dce45188af145705fa546e4d1de745428f6b01dfd423
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-