General
-
Target
Document xlx.tar.gz
-
Size
312KB
-
Sample
210810-gskaalkc26
-
MD5
aa9b3df465a8c0cdd9a9d3a3002c710e
-
SHA1
7565f30a3a07fa772c2895e5551fab5e4d345f82
-
SHA256
24631d0bf4fc0d21fffd1edb43a1abb5965e5f099f675818500c848844df3451
-
SHA512
996a0ea35d45e52bf3472606aaa0ebdb6a81beb3cc023819816f96e12d9bd1031fb5739b944b17d3a3342e2057001c4ceb49cf5a8cd3de27fa7d01fc99c61fbb
Static task
static1
Behavioral task
behavioral1
Sample
8ee60423bc1f9d704f96b7806b39819a.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
8ee60423bc1f9d704f96b7806b39819a.exe
Resource
win10v20210410
Malware Config
Extracted
warzonerat
tobi12345.hopto.org:50501
Targets
-
-
Target
8ee60423bc1f9d704f96b7806b39819a.exe
-
Size
322KB
-
MD5
909737a0a11765901cdce436737ac172
-
SHA1
00d77473c837e0ed2887d6285a6c3c9e47ec83c8
-
SHA256
39cd390039e7ad850abd64cfc0b387c77470153c09d35108cf96a893185804a2
-
SHA512
e0989e9178201f126cc600b2d64c3609ff58f7ee3ab55f177fd7301f32cf13322afe7fdbe7334c52892ffc4f5b193fb38d841371c196ac44341bd54211dab2a2
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-