General
-
Target
AWB06152022.js
-
Size
491KB
-
Sample
220615-tahq7sgfc7
-
MD5
9132b6feb40cf5d30ee938e72a505826
-
SHA1
30cc4aa2aa1b2e2698beb6b8b6a878523913dd2c
-
SHA256
98cc9c29783c707d3981c59c3cb48474cd4c99a58db0b13fb3dc96ade0e50fba
-
SHA512
7d7862ec8a3446be4769e6ccb0ca209f3ab01a7b0581f57182b3373e2f43374339c3887c624181d7820fc105c9fd5c48e7c000c45c93e077cca095312affce09
Static task
static1
Behavioral task
behavioral1
Sample
AWB06152022.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
AWB06152022.js
Resource
win10-20220414-en
Malware Config
Extracted
vjw0rm
http://franmhort.duia.ro:8152
Targets
-
-
Target
AWB06152022.js
-
Size
491KB
-
MD5
9132b6feb40cf5d30ee938e72a505826
-
SHA1
30cc4aa2aa1b2e2698beb6b8b6a878523913dd2c
-
SHA256
98cc9c29783c707d3981c59c3cb48474cd4c99a58db0b13fb3dc96ade0e50fba
-
SHA512
7d7862ec8a3446be4769e6ccb0ca209f3ab01a7b0581f57182b3373e2f43374339c3887c624181d7820fc105c9fd5c48e7c000c45c93e077cca095312affce09
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets DLL path for service in the registry
-
Drops startup file
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Modifies WinLogon
-
Drops file in System32 directory
-