General
-
Target
160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6
-
Size
971KB
-
Sample
211108-w2v7qacha6
-
MD5
08588477f0297262109025dcdf0a3237
-
SHA1
7ad57afccfcd18966c077e68fa3934ee1d9393ed
-
SHA256
160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6
-
SHA512
82c1f32635293b1ed714ee1242b201d39a5a7cb858705506b9202f14b59f863f3ce2287900dee6086dc2c459db0a343fc4663fde983ca8140d859b95c86decfb
Malware Config
Extracted
warzonerat
darkworldblackerlocker.dumb1.com:5270
Extracted
xloader
2.5
poni
http://www.camimac.com/poni/
privateerspacecompany.space
underwatergirlart.com
findphotographersonline.com
xperthardware.com
skydeksolutions.com
pet-regi.net
stoltenbergbethelpark.com
kruithofkenter.com
kryptocoaching.com
glenndcp.com
greaterhealthyliving.com
vfjofr.com
rbtos.com
eyxzlr.xyz
cdhczs.com
011atk.xyz
homemasterpro.store
equipesaudeimporta.online
baskaty.com
mindstone.gmbh
Extracted
nanocore
1.2.2.0
lockerrollercooller.mywire.org:54941
127.0.0.1:54941
968b64dd-a1e5-4192-b7da-7c0a1f44cca5
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-08-10T00:29:28.268699536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54941
-
default_group
Runner-R
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
968b64dd-a1e5-4192-b7da-7c0a1f44cca5
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
lockerrollercooller.mywire.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6
-
Size
971KB
-
MD5
08588477f0297262109025dcdf0a3237
-
SHA1
7ad57afccfcd18966c077e68fa3934ee1d9393ed
-
SHA256
160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6
-
SHA512
82c1f32635293b1ed714ee1242b201d39a5a7cb858705506b9202f14b59f863f3ce2287900dee6086dc2c459db0a343fc4663fde983ca8140d859b95c86decfb
Score10/10-
Modifies WinLogon for persistence
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Warzone RAT Payload
-
Xloader Payload
-
Executes dropped EXE
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Checks whether UAC is enabled
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-