General
-
Target
new.bin.zip
-
Size
269KB
-
Sample
210717-pb9y65dfpe
-
MD5
2acf48abf989898d6bcf8dddfd8d621d
-
SHA1
a9a468bb3740b868b80330f5849d11ca2803660d
-
SHA256
39fb1a47b9dd909768be83b9e05f2c883dc20f43397cc5bfa772268a1c61bd5d
-
SHA512
64864371ea613fc48c2c29252956c86010c65327bc3225d0150ccc3504d8e7016429cebbe8fd8f91732d15b0c2c10da71b0ebe4cc1150d887c80cf54588d5460
Static task
static1
Behavioral task
behavioral1
Sample
new.bin.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
new.bin.exe
Resource
win10v20210408
Malware Config
Extracted
warzonerat
23.82.140.14:433
Targets
-
-
Target
new.bin
-
Size
1.6MB
-
MD5
40e3805e5cad44b618fd0656ec933c9c
-
SHA1
ae638966794b68432c4fcc78acc0ac3375f9a842
-
SHA256
7dd1dba508f4b74d50a22f41f0efe3ff4bc30339e9eef45d390d32de2aa2ca2b
-
SHA512
97c8388ccdc0af8945c241133cfb0953359ccbc476e516bd555fa94f0f4348dc27832af4ab8334f9559caeda0c090edd6596e7b9ee0fcd5aefb89721bc7257ef
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-