General
-
Target
AWB06152022.js
-
Size
491KB
-
Sample
220615-w26y8aaffr
-
MD5
9132b6feb40cf5d30ee938e72a505826
-
SHA1
30cc4aa2aa1b2e2698beb6b8b6a878523913dd2c
-
SHA256
98cc9c29783c707d3981c59c3cb48474cd4c99a58db0b13fb3dc96ade0e50fba
-
SHA512
7d7862ec8a3446be4769e6ccb0ca209f3ab01a7b0581f57182b3373e2f43374339c3887c624181d7820fc105c9fd5c48e7c000c45c93e077cca095312affce09
Static task
static1
Behavioral task
behavioral1
Sample
AWB06152022.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
AWB06152022.js
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
AWB06152022.js
-
Size
491KB
-
MD5
9132b6feb40cf5d30ee938e72a505826
-
SHA1
30cc4aa2aa1b2e2698beb6b8b6a878523913dd2c
-
SHA256
98cc9c29783c707d3981c59c3cb48474cd4c99a58db0b13fb3dc96ade0e50fba
-
SHA512
7d7862ec8a3446be4769e6ccb0ca209f3ab01a7b0581f57182b3373e2f43374339c3887c624181d7820fc105c9fd5c48e7c000c45c93e077cca095312affce09
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-