warzonerat | a8a83660ed3a1903b40f935a7b6b9170[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
a8a83660ed3a1903b40f935a7b6b9170.exe
Size 113KB
Sample220817-rfjvcabeg2
SHA256 bde560e8a84bef5b1422ef285963f29f653c683f96e3b83c40e81c41fa266d2f
MD5 a8a83660ed3a1903b40f935a7b6b9170
SHA1 45907b85fb885f036f207191b74067cc2e48556d
SHA512 5fc316831adca541a537c082e01701f635a97718fae91ebc5aed81d87ef0c72e524c80e1aee86b73b67b4d226dfb20e37ef5eb2c345e3c0899dcd30850849577
SSDEEP 1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

194.5.98.201:9951

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

File Explorer

a8a83660ed3a1903b40f935a7b6b9170.exe

.exe 113KB

a8a83660ed3a1903b40f935a7b6b9170.exe

IMPHASH 51a1d638436da72d7fa5fb524e02d427
SHA256 bde560e8a84bef5b1422ef285963f29f653c683f96e3b83c40e81c41fa266d2f
MD5 a8a83660ed3a1903b40f935a7b6b9170
SHA1 45907b85fb885f036f207191b74067cc2e48556d
SHA512 5fc316831adca541a537c082e01701f635a97718fae91ebc5aed81d87ef0c72e524c80e1aee86b73b67b4d226dfb20e37ef5eb2c345e3c0899dcd30850849577
SSDEEP 1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT payload

rat

Minor OS version

Major OS version

Entry point

23778

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

bcrypt

BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt

kernel32

HeapFree VirtualAlloc HeapReAlloc VirtualQuery TerminateThread CreateThread WriteProcessMemory GetCurrentProcess OpenProcess GetWindowsDirectoryA VirtualProtectEx VirtualAllocEx CreateRemoteThread CreateProcessA GetModuleHandleW IsWow64Process WriteFile CreateFileW LoadLibraryW GetLocalTime GetCurrentThreadId GetCurrentProcessId ReadFile FindFirstFileA GetBinaryTypeW FindNextFileA GetFullPathNameA GetTempPathW GetPrivateProfileStringW CreateFileA GlobalAlloc GetCurrentDirectoryW SetCurrentDirectoryW GetFileSize FreeLibrary SetDllDirectoryW GetFileSizeEx LoadLibraryA LocalFree WaitForSingleObject WaitForMultipleObjects CreatePipe PeekNamedPipe DuplicateHandle SetEvent GetStartupInfoA CreateEventA GetModuleFileNameW LoadResource FindResourceW GetComputerNameW GlobalMemoryStatusEx LoadLibraryExW FindFirstFileW FindNextFileW SetFilePointer GetLogicalDriveStringsW DeleteFileW CopyFileW GetDriveTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetProcessHeap ReleaseMutex TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW SizeofResource VirtualProtect GetSystemDirectoryW LockResource GetWindowsDirectoryW Process32First Process32Next WinExec GetTempPathA HeapAlloc lstrcmpW GetTickCount lstrcpyW WideCharToMultiByte lstrcpyA Sleep MultiByteToWideChar GetCommandLineA GetModuleHandleA ExitProcess CreateProcessW lstrcatA lstrcmpA lstrlenA ExpandEnvironmentStringsW lstrlenW CloseHandle lstrcatW GetLastError VirtualFree GetProcAddress SetLastError GetModuleFileNameA CreateDirectoryW LocalAlloc CreateMutexA

user32

GetKeyState GetMessageA DispatchMessageA CreateWindowExW CallNextHookEx GetAsyncKeyState RegisterClassW GetRawInputData MapVirtualKeyA DefWindowProcA RegisterRawInputDevices TranslateMessage GetForegroundWindow GetKeyNameTextW PostQuitMessage MessageBoxA GetLastInputInfo wsprintfW GetWindowTextW wsprintfA ToUnicode

advapi32

RegDeleteKeyW RegCreateKeyExW RegSetValueExA RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken InitializeSecurityDescriptor RegDeleteKeyA SetSecurityDescriptorDacl RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegQueryValueExA RegQueryInfoKeyW RegCloseKey OpenServiceW ChangeServiceConfigW QueryServiceConfigW EnumServicesStatusExW StartServiceW RegSetValueExW RegCreateKeyExA OpenSCManagerW CloseServiceHandle GetTokenInformation LookupAccountSidW FreeSid RegQueryValueExW

shell32

ShellExecuteExA ShellExecuteExW ord680 SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW SHGetFolderPathW SHGetKnownFolderPath

urlmon

URLDownloadToFileW

ws2_32

htons recv connect socket send WSAStartup shutdown closesocket WSACleanup InetNtopW gethostbyname inet_addr getaddrinfo setsockopt freeaddrinfo

ole32

CoInitializeSecurity CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree

shlwapi

StrStrW PathRemoveFileSpecA StrStrA PathCombineA PathFindFileNameW PathFileExistsW PathFindExtensionW

netapi32

NetLocalGroupAddMembers NetUserAdd

oleaut32

VariantInit

crypt32

CryptUnprotectData CryptStringToBinaryA CryptStringToBinaryW

psapi

GetModuleFileNameExW