warzonerat | 83194f4cec3ca91c50818702e33251d5

Sharing

Copy URL Twitter E-mail

General

Target
83194f4cec3ca91c50818702e33251d5
Size 113KB
Sample220121-fgvgpadeap
SHA256 331576755451134a074599263c0289b5092b1c489a91afaf911c8414fda98713
MD5 83194f4cec3ca91c50818702e33251d5
SHA1 57d6a1cfaba2f0b14f4d2e47c50351a46f28745f
SHA512 ad03829483195073d42742b562f4817f3e9d09b700c264b47bfe58734044d822eb514ec51d783f87b1181a67a6f1734cd82bc334689dda600404ddc452c5294c
SSDEEP 1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

194.5.98.18:5200

Signatures

Warzone RAT Payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

File Explorer

83194f4cec3ca91c50818702e33251d5

.exe 113KB

83194f4cec3ca91c50818702e33251d5

IMPHASH 51a1d638436da72d7fa5fb524e02d427
SHA256 331576755451134a074599263c0289b5092b1c489a91afaf911c8414fda98713
MD5 83194f4cec3ca91c50818702e33251d5
SHA1 57d6a1cfaba2f0b14f4d2e47c50351a46f28745f
SHA512 ad03829483195073d42742b562f4817f3e9d09b700c264b47bfe58734044d822eb514ec51d783f87b1181a67a6f1734cd82bc334689dda600404ddc452c5294c
SSDEEP 1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT Payload

rat

Minor OS version

Major OS version

Entry point

23778

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

bcrypt

BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt

kernel32

HeapFree VirtualAlloc HeapReAlloc VirtualQuery TerminateThread CreateThread WriteProcessMemory GetCurrentProcess OpenProcess GetWindowsDirectoryA VirtualProtectEx VirtualAllocEx CreateRemoteThread CreateProcessA GetModuleHandleW IsWow64Process WriteFile CreateFileW LoadLibraryW GetLocalTime GetCurrentThreadId GetCurrentProcessId ReadFile FindFirstFileA GetBinaryTypeW FindNextFileA GetFullPathNameA GetTempPathW GetPrivateProfileStringW CreateFileA GlobalAlloc GetCurrentDirectoryW SetCurrentDirectoryW GetFileSize FreeLibrary SetDllDirectoryW GetFileSizeEx LoadLibraryA LocalFree WaitForSingleObject WaitForMultipleObjects CreatePipe PeekNamedPipe DuplicateHandle SetEvent GetStartupInfoA CreateEventA GetModuleFileNameW LoadResource FindResourceW GetComputerNameW GlobalMemoryStatusEx LoadLibraryExW FindFirstFileW FindNextFileW SetFilePointer GetLogicalDriveStringsW DeleteFileW CopyFileW GetDriveTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetProcessHeap ReleaseMutex TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW SizeofResource VirtualProtect GetSystemDirectoryW LockResource GetWindowsDirectoryW Process32First Process32Next WinExec GetTempPathA HeapAlloc lstrcmpW GetTickCount lstrcpyW WideCharToMultiByte lstrcpyA Sleep MultiByteToWideChar GetCommandLineA GetModuleHandleA ExitProcess CreateProcessW lstrcatA lstrcmpA lstrlenA ExpandEnvironmentStringsW lstrlenW CloseHandle lstrcatW GetLastError VirtualFree GetProcAddress SetLastError GetModuleFileNameA CreateDirectoryW LocalAlloc CreateMutexA

user32

GetKeyState GetMessageA DispatchMessageA CreateWindowExW CallNextHookEx GetAsyncKeyState RegisterClassW GetRawInputData MapVirtualKeyA DefWindowProcA RegisterRawInputDevices TranslateMessage GetForegroundWindow GetKeyNameTextW PostQuitMessage MessageBoxA GetLastInputInfo wsprintfW GetWindowTextW wsprintfA ToUnicode

advapi32

RegDeleteKeyW RegCreateKeyExW RegSetValueExA RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken InitializeSecurityDescriptor RegDeleteKeyA SetSecurityDescriptorDacl RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegQueryValueExA RegQueryInfoKeyW RegCloseKey OpenServiceW ChangeServiceConfigW QueryServiceConfigW EnumServicesStatusExW StartServiceW RegSetValueExW RegCreateKeyExA OpenSCManagerW CloseServiceHandle GetTokenInformation LookupAccountSidW FreeSid RegQueryValueExW

shell32

ShellExecuteExA ShellExecuteExW ord680 SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW SHGetFolderPathW SHGetKnownFolderPath

urlmon

URLDownloadToFileW

ws2_32

htons recv connect socket send WSAStartup shutdown closesocket WSACleanup InetNtopW gethostbyname inet_addr getaddrinfo setsockopt freeaddrinfo

ole32

CoInitializeSecurity CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree

shlwapi

StrStrW PathRemoveFileSpecA StrStrA PathCombineA PathFindFileNameW PathFileExistsW PathFindExtensionW

netapi32

NetLocalGroupAddMembers NetUserAdd

oleaut32

VariantInit

crypt32

CryptUnprotectData CryptStringToBinaryA CryptStringToBinaryW

psapi

GetModuleFileNameExW