General
-
Target
PCS TENDER PROFILE-20210920.r00
-
Size
5KB
-
Sample
211012-whreeschb6
-
MD5
9de06e8a49941048af4a52b9a8e4504c
-
SHA1
7ce57379d122822d2ff040c4704fc86dbe711517
-
SHA256
dbce69c132d28f4b9f33cecfd7991bf1d8cfa043c534c9fd724fd6d1413619af
-
SHA512
4543fee35a79e885600a2e6967948dda444e9858d2edb184c47e78ed16622495dd97f805b7ced7ff00912e7b2a9b57d1b00befb2e4e27b0b85356e3920816bb0
Static task
static1
Behavioral task
behavioral1
Sample
PCS TENDER PROFILE-20210920.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
PCS TENDER PROFILE-20210920.exe
Resource
win10v20210408
Malware Config
Extracted
warzonerat
enginekeysmoney.ddns.net:9671
Targets
-
-
Target
PCS TENDER PROFILE-20210920.exe
-
Size
24KB
-
MD5
8475c4b32e4c24086dcef73a6c05fe3e
-
SHA1
b36a3579be00a9b414ff8e34dd6e1d944214c0c3
-
SHA256
a44ab6dc43269d5f7f13aefc084b0a4d463126eea8a3de38979b5f5f96ea6a8d
-
SHA512
d3d0e1ef48432ca5351ea919e7fe99388ed941e128c82b937d6eb94bd91c00fca6784e7df99498de68ae0ce8352dfa266d316c4bbfa716abef31a69a4922646b
Score10/10-
Modifies WinLogon for persistence
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Suspicious use of SetThreadContext
-