General
-
Target
08588477f0297262109025dcdf0a3237
-
Size
971KB
-
Sample
211108-xd26sshheq
-
MD5
08588477f0297262109025dcdf0a3237
-
SHA1
7ad57afccfcd18966c077e68fa3934ee1d9393ed
-
SHA256
160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6
-
SHA512
82c1f32635293b1ed714ee1242b201d39a5a7cb858705506b9202f14b59f863f3ce2287900dee6086dc2c459db0a343fc4663fde983ca8140d859b95c86decfb
Static task
static1
Malware Config
Extracted
warzonerat
darkworldblackerlocker.dumb1.com:5270
Extracted
xloader
2.5
poni
http://www.camimac.com/poni/
privateerspacecompany.space
underwatergirlart.com
findphotographersonline.com
xperthardware.com
skydeksolutions.com
pet-regi.net
stoltenbergbethelpark.com
kruithofkenter.com
kryptocoaching.com
glenndcp.com
greaterhealthyliving.com
vfjofr.com
rbtos.com
eyxzlr.xyz
cdhczs.com
011atk.xyz
homemasterpro.store
equipesaudeimporta.online
baskaty.com
mindstone.gmbh
rankingforwan.xyz
fdkslfj.info
superdupermagicshoe.com
vuyt-14kkt.com
ulitka4you.store
munixc.info
floffyworld.com
dl-graphix.com
timbaker.kiwi
christialana.com
nextgenerationracingleague.com
fospine.online
embracedragonfly.com
snm.zone
delivry.digital
sscollaborative.solutions
jvrtiendaonline.com
yfly630.xyz
barco-group.com
minerstore.biz
sentshopja.com
bex-fit.com
taxmotive.com
kaelte-fath.com
pranatation.com
effioffice.com
battalsteel.com
loucksiand.com
tkn.fan
ncwz04.xyz
subito-credit.xyz
reservemyhotspot.com
godigitalbw.com
earlydose.com
clyrve.com
laoqu6666.com
capitannetwork.com
writizy.com
statsheet.xyz
devasuryan.com
artmorestudio.com
shirt-dancing.com
gizpsikolojikdanisma.com
interactdigitalhub.com
Extracted
nanocore
1.2.2.0
lockerrollercooller.mywire.org:54941
127.0.0.1:54941
968b64dd-a1e5-4192-b7da-7c0a1f44cca5
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-08-10T00:29:28.268699536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54941
-
default_group
Runner-R
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
968b64dd-a1e5-4192-b7da-7c0a1f44cca5
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
lockerrollercooller.mywire.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
08588477f0297262109025dcdf0a3237
-
Size
971KB
-
MD5
08588477f0297262109025dcdf0a3237
-
SHA1
7ad57afccfcd18966c077e68fa3934ee1d9393ed
-
SHA256
160ea3850bd5f084c27aeeebae4ae027419d9e16c0cfdfdd951ca4c7d4f64dd6
-
SHA512
82c1f32635293b1ed714ee1242b201d39a5a7cb858705506b9202f14b59f863f3ce2287900dee6086dc2c459db0a343fc4663fde983ca8140d859b95c86decfb
-
Modifies WinLogon for persistence
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Warzone RAT Payload
-
Xloader Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-