Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    tmp

  • Size

    98KB

  • Sample

    220911-lyqsqafbgl

  • MD5

    92dcfe5ccfa95ab24ed7ed2933181a8b

  • SHA1

    027ac2613387cd54463d0170889b849201f16e85

  • SHA256

    8e4f9c50d684e420c808b44d32287262f57cdbb5780dca6488556a41107d3491

  • SHA512

    86e515a88fc33b0c8773a4caa53521a96f4cf04ca09b80c79e8687363e5b054a0e82e275e8cb72c899233897a5353946ef68791673cfdb0605aac35c8c2d217e

  • SSDEEP

    1536:5Csejmb+6BQyusX1UjtA0uWRf/eloc/9T1jVEyp:AtD6jSm0uWRfCogTjVEG

Malware Config

Extracted

Family

warzonerat

C2

spicydojo.duckdns.org:2323

Targets

    • Target

      tmp

    • Size

      98KB

    • MD5

      92dcfe5ccfa95ab24ed7ed2933181a8b

    • SHA1

      027ac2613387cd54463d0170889b849201f16e85

    • SHA256

      8e4f9c50d684e420c808b44d32287262f57cdbb5780dca6488556a41107d3491

    • SHA512

      86e515a88fc33b0c8773a4caa53521a96f4cf04ca09b80c79e8687363e5b054a0e82e275e8cb72c899233897a5353946ef68791673cfdb0605aac35c8c2d217e

    • SSDEEP

      1536:5Csejmb+6BQyusX1UjtA0uWRf/eloc/9T1jVEyp:AtD6jSm0uWRfCogTjVEG

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks