warzonerat | 16256d9b6c82fec40a877c52da1aa5ae[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
16256d9b6c82fec40a877c52da1aa5ae.exe
Size 132KB
Sample220911-h94beabca3
SHA256 3da2da75681d61e8bcfde31b394b6512b4e1ba03fe7d436e9cbb9404ee95c9a5
MD5 16256d9b6c82fec40a877c52da1aa5ae
SHA1 87730e367bf64142c6b3d196425e4e828c3e51ff
SHA512 f2d25c2ea753946cddb441ba184bfb71265951fa4a16ea10edac4bba7e93ae7e75fe8ccafcf6a2c99ed691fe6aa2aabce69a1366b419f2c5f2edfb77d1a4ef23
SSDEEP 3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

mutaalofomaha.com:5566

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

File Explorer

16256d9b6c82fec40a877c52da1aa5ae.exe

.exe 132KB

16256d9b6c82fec40a877c52da1aa5ae.exe

IMPHASH 56fc94e02d7bc310030753938e49a91a
SHA256 3da2da75681d61e8bcfde31b394b6512b4e1ba03fe7d436e9cbb9404ee95c9a5
MD5 16256d9b6c82fec40a877c52da1aa5ae
SHA1 87730e367bf64142c6b3d196425e4e828c3e51ff
SHA512 f2d25c2ea753946cddb441ba184bfb71265951fa4a16ea10edac4bba7e93ae7e75fe8ccafcf6a2c99ed691fe6aa2aabce69a1366b419f2c5f2edfb77d1a4ef23
SSDEEP 3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT payload

rat

Minor OS version

Major OS version

Entry point

28068

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

webservices

WsFileTimeToDateTime

bcrypt

BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt

kernel32

lstrcpyW GetTickCount HeapAlloc GetProcessHeap GetCommandLineA GetStartupInfoA HeapFree VirtualAlloc HeapReAlloc VirtualQuery LocalAlloc LocalFree SystemTimeToFileTime TerminateThread CreateThread WriteProcessMemory GetCurrentProcess OpenProcess GetWindowsDirectoryA VirtualProtectEx VirtualAllocEx CreateRemoteThread GetModuleHandleW IsWow64Process WriteFile CreateFileW LoadLibraryW GetLocalTime GetCurrentThreadId GetCurrentProcessId ReadFile FindFirstFileA GetBinaryTypeW FindNextFileA GetFullPathNameA CreateFileA GlobalAlloc GetCurrentDirectoryW lstrcmpA GetFileSize FreeLibrary SetDllDirectoryW GetFileSizeEx WaitForSingleObject WaitForMultipleObjects CreatePipe PeekNamedPipe DuplicateHandle SetEvent CreateProcessW CreateEventA GetModuleFileNameW WideCharToMultiByte LoadResource FindResourceW GetComputerNameW GlobalMemoryStatusEx LoadLibraryExW FindFirstFileW FindNextFileW SetFilePointer GetLogicalDriveStringsW CopyFileW GetDriveTypeW EnterCriticalSection LeaveCriticalSection lstrlenA DeleteCriticalSection CreateMutexA ReleaseMutex TerminateProcess K32GetModuleFileNameExW CreateToolhelp32Snapshot Process32NextW Process32FirstW DeleteFileW SizeofResource VirtualProtect GetSystemDirectoryW LockResource GetWindowsDirectoryW Process32First Process32Next GetTempPathA ExpandEnvironmentStringsW lstrlenW lstrcmpW CreateProcessA WinExec ExitProcess GetProcAddress lstrcpyA CloseHandle lstrcatW LoadLibraryA GetLastError GetPrivateProfileStringW GetModuleHandleA GetTempPathW VirtualFree SetLastError Sleep GetModuleFileNameA CreateDirectoryW MultiByteToWideChar lstrcatA SetCurrentDirectoryW InitializeCriticalSection

user32

GetKeyState GetMessageA DispatchMessageA CreateWindowExW CallNextHookEx GetAsyncKeyState RegisterClassW GetRawInputData MapVirtualKeyA DefWindowProcA RegisterRawInputDevices TranslateMessage ToUnicode wsprintfW PostQuitMessage GetLastInputInfo GetForegroundWindow GetWindowTextW wsprintfA GetKeyNameTextW CharLowerW

advapi32

RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid LookupAccountSidW RegCreateKeyExW RegDeleteKeyW InitializeSecurityDescriptor RegDeleteKeyA SetSecurityDescriptorDacl RegQueryValueExW RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegQueryValueExA RegQueryInfoKeyW RegCloseKey OpenServiceW ChangeServiceConfigW QueryServiceConfigW EnumServicesStatusExW StartServiceW RegSetValueExW RegCreateKeyExA OpenSCManagerW CloseServiceHandle GetTokenInformation RegSetValueExA

shell32

SHGetFolderPathW ShellExecuteExA ord680 SHGetKnownFolderPath SHFileOperationW SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW

urlmon

URLDownloadToFileW

ws2_32

getaddrinfo setsockopt freeaddrinfo htons recv socket send WSAConnect WSAStartup shutdown closesocket WSACleanup connect InetNtopW gethostbyname inet_addr

ole32

CoCreateInstance CoInitialize CoTaskMemFree CoUninitialize CoInitializeSecurity

shlwapi

StrStrW PathFindExtensionW PathCombineA PathFindFileNameW StrStrA PathRemoveFileSpecA PathFileExistsW

netapi32

NetUserAdd NetLocalGroupAddMembers

oleaut32

VariantInit

crypt32

CryptUnprotectData CryptStringToBinaryA CryptStringToBinaryW

wininet

InternetTimeToSystemTimeA