General
-
Target
Ctr_no._2021000072___2021000073.PDF.exe
-
Size
777KB
-
Sample
210802-ej29hxaews
-
MD5
24f24a646d6c07a5d90605c4839b1010
-
SHA1
e908b838ffc8893ae271484c073d6e12864e518a
-
SHA256
8b1ba4999a15f0eea8a19022f6b45ec1d1926212a637d4b3ea6d0c6dae5faf51
-
SHA512
e67dfd63f140b006ae4498b859f82c5c79fbfc570405ef79fe55e9df18f9ba9fff5e6444e239dbddb82b1bd089152e0f1ca2d79205c7700b4c974fdbfb7a3b8d
Static task
static1
Behavioral task
behavioral1
Sample
Ctr_no._2021000072___2021000073.PDF.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Ctr_no._2021000072___2021000073.PDF.exe
Resource
win10v20210410
Malware Config
Extracted
warzonerat
blacice24.hopto.org:5032
Targets
-
-
Target
Ctr_no._2021000072___2021000073.PDF.exe
-
Size
777KB
-
MD5
24f24a646d6c07a5d90605c4839b1010
-
SHA1
e908b838ffc8893ae271484c073d6e12864e518a
-
SHA256
8b1ba4999a15f0eea8a19022f6b45ec1d1926212a637d4b3ea6d0c6dae5faf51
-
SHA512
e67dfd63f140b006ae4498b859f82c5c79fbfc570405ef79fe55e9df18f9ba9fff5e6444e239dbddb82b1bd089152e0f1ca2d79205c7700b4c974fdbfb7a3b8d
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Loads dropped DLL
-
Adds Run key to start application
-