General
-
Target
IMG_RFQ70103260100057.exe
-
Size
28KB
-
Sample
211019-qekjtaggbj
-
MD5
4ca7ad65e21778c4ec8fab5129260d32
-
SHA1
461ae78946a55078590300798f08bc00e0e10d9d
-
SHA256
073a9a5eaf10598b2ebf99094fc29e04778ee7272319687d04c53f3d903de94c
-
SHA512
31b22762c0fb2d3d6c39bb5bd94c322a7d13cd6c5fd297e79955cd0095cbd4aaf7f4ab208ac304bf3069ce218a733dae6ac85d65cf15995bcbe649ad705820e8
Static task
static1
Behavioral task
behavioral1
Sample
IMG_RFQ70103260100057.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
IMG_RFQ70103260100057.exe
Resource
win10-en-20211014
Malware Config
Extracted
warzonerat
enginekeysmoney.ddns.net:9671
Targets
-
-
Target
IMG_RFQ70103260100057.exe
-
Size
28KB
-
MD5
4ca7ad65e21778c4ec8fab5129260d32
-
SHA1
461ae78946a55078590300798f08bc00e0e10d9d
-
SHA256
073a9a5eaf10598b2ebf99094fc29e04778ee7272319687d04c53f3d903de94c
-
SHA512
31b22762c0fb2d3d6c39bb5bd94c322a7d13cd6c5fd297e79955cd0095cbd4aaf7f4ab208ac304bf3069ce218a733dae6ac85d65cf15995bcbe649ad705820e8
-
Modifies WinLogon for persistence
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-