General
-
Target
86b5e26eea4612d509a34583f0820a0f2ad636f62cf76e4aca09b10a84069789
-
Size
1.3MB
-
Sample
220217-aadmpsfhap
-
MD5
ce8de2bd1d566050e2fa74ad44fcb4b7
-
SHA1
bce57800b00dd4707b3f0c3030ac653bd5ab618a
-
SHA256
86b5e26eea4612d509a34583f0820a0f2ad636f62cf76e4aca09b10a84069789
-
SHA512
2fd1e87f2fbc1bd9365f87179254ea9084349c9acbf4b0469eebdf38a2ba87699ad242c55d05cf7f3a47d37d9dd86f5518e29a825c2fbd2a3238f4648432070e
Behavioral task
behavioral1
Sample
86b5e26eea4612d509a34583f0820a0f2ad636f62cf76e4aca09b10a84069789.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
86b5e26eea4612d509a34583f0820a0f2ad636f62cf76e4aca09b10a84069789.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
warzonerat
wealth.warzonedns.com:5202
Targets
-
-
Target
86b5e26eea4612d509a34583f0820a0f2ad636f62cf76e4aca09b10a84069789
-
Size
1.3MB
-
MD5
ce8de2bd1d566050e2fa74ad44fcb4b7
-
SHA1
bce57800b00dd4707b3f0c3030ac653bd5ab618a
-
SHA256
86b5e26eea4612d509a34583f0820a0f2ad636f62cf76e4aca09b10a84069789
-
SHA512
2fd1e87f2fbc1bd9365f87179254ea9084349c9acbf4b0469eebdf38a2ba87699ad242c55d05cf7f3a47d37d9dd86f5518e29a825c2fbd2a3238f4648432070e
Score10/10-
NetWire RAT payload
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-
autoit_exe
AutoIT scripts compiled to PE executables.
-