General
-
Target
Jqqzrja.exe
-
Size
944KB
-
Sample
220422-teqmlsdfb7
-
MD5
08a179cfc5c59fe478a80f65b2a0f5b2
-
SHA1
d6648e3830f971162143d8e1d4a6054175559174
-
SHA256
2c7e36d7f10ff9b97bd4bf6c8a5a63f620b2aad8683984a54e12f97b73302a18
-
SHA512
b6b1d7b7b286174e5fdcdea3380174604326c849f6b1bf41ad0b2f440ca92a6705bfca7acaaf4ca0fdedf78f063076cd78c715e17d55e8198c6bb59836df71b4
Static task
static1
Behavioral task
behavioral1
Sample
Jqqzrja.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Jqqzrja.exe
Resource
win10-20220414-en
Malware Config
Extracted
warzonerat
pentester01.duckdns.org:54788
Targets
-
-
Target
Jqqzrja.exe
-
Size
944KB
-
MD5
08a179cfc5c59fe478a80f65b2a0f5b2
-
SHA1
d6648e3830f971162143d8e1d4a6054175559174
-
SHA256
2c7e36d7f10ff9b97bd4bf6c8a5a63f620b2aad8683984a54e12f97b73302a18
-
SHA512
b6b1d7b7b286174e5fdcdea3380174604326c849f6b1bf41ad0b2f440ca92a6705bfca7acaaf4ca0fdedf78f063076cd78c715e17d55e8198c6bb59836df71b4
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Adds Run key to start application
-