General
-
Target
4D77D28CBF980EDCC459AC5F2E56E8EA1CE9534C97CBE.exe
-
Size
921KB
-
Sample
221004-rwdm9sbeek
-
MD5
b70564d880ae73339db8be8b7b387e3b
-
SHA1
642aa05ed3cddba9784a7499637c05eb79471ff8
-
SHA256
4d77d28cbf980edcc459ac5f2e56e8ea1ce9534c97cbeeb57739dbb66756fc33
-
SHA512
f1870be369f08ddbdea6d4223322d22003317d793aee07b1e705dd5d56ebe08ef0ac66a420b13d1504d0ac45269dec66a1c9e8eb1918974d0122b7ff00042e19
-
SSDEEP
12288:AJUHQf66vLY0QWoYa5RsDDVQdDPf+rKU5IT7greRccA/s/rsGvRcZoYto:AsoUQin8uerHqRcv/sHsoIo
Static task
static1
Behavioral task
behavioral1
Sample
4D77D28CBF980EDCC459AC5F2E56E8EA1CE9534C97CBE.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4D77D28CBF980EDCC459AC5F2E56E8EA1CE9534C97CBE.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
warzonerat
ekuroekuro.duckdns.org:5200
Targets
-
-
Target
4D77D28CBF980EDCC459AC5F2E56E8EA1CE9534C97CBE.exe
-
Size
921KB
-
MD5
b70564d880ae73339db8be8b7b387e3b
-
SHA1
642aa05ed3cddba9784a7499637c05eb79471ff8
-
SHA256
4d77d28cbf980edcc459ac5f2e56e8ea1ce9534c97cbeeb57739dbb66756fc33
-
SHA512
f1870be369f08ddbdea6d4223322d22003317d793aee07b1e705dd5d56ebe08ef0ac66a420b13d1504d0ac45269dec66a1c9e8eb1918974d0122b7ff00042e19
-
SSDEEP
12288:AJUHQf66vLY0QWoYa5RsDDVQdDPf+rKU5IT7greRccA/s/rsGvRcZoYto:AsoUQin8uerHqRcv/sHsoIo
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-