warzonerat | 0b756fd941b8e7bb06b00769a7ea11ea

Sharing

Copy URL Twitter E-mail

General

Target
0b756fd941b8e7bb06b00769a7ea11ea
Size 113KB
Sample220708-nwqfaacben
SHA256 df17ddbb17aca701b0b9e7fee6a5ef94e0e952d72f984f70c04240b90acfff27
MD5 0b756fd941b8e7bb06b00769a7ea11ea
SHA1 101d57848d51c25f07ec64c081cad78c0b689802
SHA512 455bd2c51948dece8b9a91954d1467021abdc996aa45ad0bbce64b609c7fb5e3565bd5ddd9f1d79344a37db371e64e4679e4a7f89b9b7e988db0c90131c7d699
SSDEEP 1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

zopzw.ddns.net:5059

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

File Explorer

0b756fd941b8e7bb06b00769a7ea11ea

.exe 113KB

0b756fd941b8e7bb06b00769a7ea11ea

IMPHASH 51a1d638436da72d7fa5fb524e02d427
SHA256 df17ddbb17aca701b0b9e7fee6a5ef94e0e952d72f984f70c04240b90acfff27
MD5 0b756fd941b8e7bb06b00769a7ea11ea
SHA1 101d57848d51c25f07ec64c081cad78c0b689802
SHA512 455bd2c51948dece8b9a91954d1467021abdc996aa45ad0bbce64b609c7fb5e3565bd5ddd9f1d79344a37db371e64e4679e4a7f89b9b7e988db0c90131c7d699
SSDEEP 1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT payload

rat

Minor OS version

Major OS version

Entry point

23778

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

bcrypt

BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt

kernel32

HeapFree VirtualAlloc HeapReAlloc VirtualQuery TerminateThread CreateThread WriteProcessMemory GetCurrentProcess OpenProcess GetWindowsDirectoryA VirtualProtectEx VirtualAllocEx CreateRemoteThread CreateProcessA GetModuleHandleW IsWow64Process WriteFile CreateFileW LoadLibraryW GetLocalTime GetCurrentThreadId GetCurrentProcessId ReadFile FindFirstFileA GetBinaryTypeW FindNextFileA GetFullPathNameA GetTempPathW GetPrivateProfileStringW CreateFileA GlobalAlloc GetCurrentDirectoryW SetCurrentDirectoryW GetFileSize FreeLibrary SetDllDirectoryW GetFileSizeEx LoadLibraryA LocalFree WaitForSingleObject WaitForMultipleObjects CreatePipe PeekNamedPipe DuplicateHandle SetEvent GetStartupInfoA CreateEventA GetModuleFileNameW LoadResource FindResourceW GetComputerNameW GlobalMemoryStatusEx LoadLibraryExW FindFirstFileW FindNextFileW SetFilePointer GetLogicalDriveStringsW DeleteFileW CopyFileW GetDriveTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetProcessHeap ReleaseMutex TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW SizeofResource VirtualProtect GetSystemDirectoryW LockResource GetWindowsDirectoryW Process32First Process32Next WinExec GetTempPathA HeapAlloc lstrcmpW GetTickCount lstrcpyW WideCharToMultiByte lstrcpyA Sleep MultiByteToWideChar GetCommandLineA GetModuleHandleA ExitProcess CreateProcessW lstrcatA lstrcmpA lstrlenA ExpandEnvironmentStringsW lstrlenW CloseHandle lstrcatW GetLastError VirtualFree GetProcAddress SetLastError GetModuleFileNameA CreateDirectoryW LocalAlloc CreateMutexA

user32

GetKeyState GetMessageA DispatchMessageA CreateWindowExW CallNextHookEx GetAsyncKeyState RegisterClassW GetRawInputData MapVirtualKeyA DefWindowProcA RegisterRawInputDevices TranslateMessage GetForegroundWindow GetKeyNameTextW PostQuitMessage MessageBoxA GetLastInputInfo wsprintfW GetWindowTextW wsprintfA ToUnicode

advapi32

RegDeleteKeyW RegCreateKeyExW RegSetValueExA RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken InitializeSecurityDescriptor RegDeleteKeyA SetSecurityDescriptorDacl RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegQueryValueExA RegQueryInfoKeyW RegCloseKey OpenServiceW ChangeServiceConfigW QueryServiceConfigW EnumServicesStatusExW StartServiceW RegSetValueExW RegCreateKeyExA OpenSCManagerW CloseServiceHandle GetTokenInformation LookupAccountSidW FreeSid RegQueryValueExW

shell32

ShellExecuteExA ShellExecuteExW ord680 SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW SHGetFolderPathW SHGetKnownFolderPath

urlmon

URLDownloadToFileW

ws2_32

htons recv connect socket send WSAStartup shutdown closesocket WSACleanup InetNtopW gethostbyname inet_addr getaddrinfo setsockopt freeaddrinfo

ole32

CoInitializeSecurity CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree

shlwapi

StrStrW PathRemoveFileSpecA StrStrA PathCombineA PathFindFileNameW PathFileExistsW PathFindExtensionW

netapi32

NetLocalGroupAddMembers NetUserAdd

oleaut32

VariantInit

crypt32

CryptUnprotectData CryptStringToBinaryA CryptStringToBinaryW

psapi

GetModuleFileNameExW