General
-
Target
SecuriteInfo.com.Trojan.KillAV.152.22494.23947
-
Size
916KB
-
Sample
220806-ajxf6sgear
-
MD5
886d7d554974f5bb08293aa27ef675e1
-
SHA1
99601fe9c8e9db26e5f18b385bc3dd3211c947c5
-
SHA256
53afdc42be1963738ca47d55c4d2943257797b7ffa2775abdce09e6e9d959cb8
-
SHA512
ca18220abf1d6d05c6525a83deb1c67c4542eaad9ad438f8c95907a96de15d5553be90195206cfb60a4ba08ff5e9896df3ff0e05e04519e6ad9bba537ecc1bdd
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.KillAV.152.22494.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.KillAV.152.22494.exe
Resource
win10v2004-20220722-en
Malware Config
Extracted
warzonerat
20.91.187.223:5707
Targets
-
-
Target
SecuriteInfo.com.Trojan.KillAV.152.22494.23947
-
Size
916KB
-
MD5
886d7d554974f5bb08293aa27ef675e1
-
SHA1
99601fe9c8e9db26e5f18b385bc3dd3211c947c5
-
SHA256
53afdc42be1963738ca47d55c4d2943257797b7ffa2775abdce09e6e9d959cb8
-
SHA512
ca18220abf1d6d05c6525a83deb1c67c4542eaad9ad438f8c95907a96de15d5553be90195206cfb60a4ba08ff5e9896df3ff0e05e04519e6ad9bba537ecc1bdd
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-