General
-
Target
364e40063a733c84ebc32bef5ef670e82759effe
-
Size
1.1MB
-
Sample
221007-cqh88sbegk
-
MD5
ef086ba45f0a256f399b34ec7fb95de0
-
SHA1
364e40063a733c84ebc32bef5ef670e82759effe
-
SHA256
2b20d4fe1f4b543fb96b4c713e2cf0d549ba923eaed35195752590daebaae8e9
-
SHA512
3b80a8646584dbf346833c9a4267645016e8e5de9eb0247e98e74629697e12830dc86165ea16f1373085ef747eac2a40dd0712948f1b6fd9a66f48f4b170e0bd
-
SSDEEP
24576:mkS1iKn5q5M4y7BAgAiIekzFgYglCO2XeLoPx:mkNl5aivAlCfOLoJ
Static task
static1
Behavioral task
behavioral1
Sample
364e40063a733c84ebc32bef5ef670e82759effe.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
warzonerat
pentester01.duckdns.org:44902
Targets
-
-
Target
364e40063a733c84ebc32bef5ef670e82759effe
-
Size
1.1MB
-
MD5
ef086ba45f0a256f399b34ec7fb95de0
-
SHA1
364e40063a733c84ebc32bef5ef670e82759effe
-
SHA256
2b20d4fe1f4b543fb96b4c713e2cf0d549ba923eaed35195752590daebaae8e9
-
SHA512
3b80a8646584dbf346833c9a4267645016e8e5de9eb0247e98e74629697e12830dc86165ea16f1373085ef747eac2a40dd0712948f1b6fd9a66f48f4b170e0bd
-
SSDEEP
24576:mkS1iKn5q5M4y7BAgAiIekzFgYglCO2XeLoPx:mkNl5aivAlCfOLoJ
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Adds Run key to start application
-