General
-
Target
9e6b019dfbd2127debf97d9700db1efa
-
Size
819KB
-
Sample
210915-hyetnsaaf9
-
MD5
9e6b019dfbd2127debf97d9700db1efa
-
SHA1
6dac4ba3a4a2eed8e8646b254d369a9ce36ac04e
-
SHA256
14b699de8b60b775bd609d8b07b70d0f1bbb850e75347d9b925e54c8dba68fd1
-
SHA512
a2775d7a2fc1263d90c9aa1b9a767196a37270637a26735307bc75b39a797b1cfe6d0a7d181958ab1253ce21b3ce74ace4fccc0701d564cb5abf88ad56e07f83
Static task
static1
Behavioral task
behavioral1
Sample
9e6b019dfbd2127debf97d9700db1efa.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
9e6b019dfbd2127debf97d9700db1efa.exe
Resource
win10v20210408
Malware Config
Extracted
warzonerat
194.127.179.121:5010
Targets
-
-
Target
9e6b019dfbd2127debf97d9700db1efa
-
Size
819KB
-
MD5
9e6b019dfbd2127debf97d9700db1efa
-
SHA1
6dac4ba3a4a2eed8e8646b254d369a9ce36ac04e
-
SHA256
14b699de8b60b775bd609d8b07b70d0f1bbb850e75347d9b925e54c8dba68fd1
-
SHA512
a2775d7a2fc1263d90c9aa1b9a767196a37270637a26735307bc75b39a797b1cfe6d0a7d181958ab1253ce21b3ce74ace4fccc0701d564cb5abf88ad56e07f83
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Adds Run key to start application
-