General
-
Target
4e72f9068a19d1b59183b5a9a2e8ccedd5b2165fc523828002f8a584d3cada49.exe
-
Size
938KB
-
Sample
221007-pdq5jacehn
-
MD5
7e42d0878d53b209a5e8946c1beacc1b
-
SHA1
9a808ead9c9d878de69a1fe1f18cb7de8a4ac12a
-
SHA256
4e72f9068a19d1b59183b5a9a2e8ccedd5b2165fc523828002f8a584d3cada49
-
SHA512
d83989bb6444a76b2963b95cc29750cbaaa8be694ab3cddd12f8cb9996ad1b4a3c6213a1abb2ae5b6975e82eece9e20c7a2e0362a28e2ad4755e983e9047584a
-
SSDEEP
24576:v5Maj9nvBouda27spxjoBUjdhXxYA7/X:v3L4VfmU
Static task
static1
Behavioral task
behavioral1
Sample
4e72f9068a19d1b59183b5a9a2e8ccedd5b2165fc523828002f8a584d3cada49.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4e72f9068a19d1b59183b5a9a2e8ccedd5b2165fc523828002f8a584d3cada49.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
warzonerat
febrem1.ddns.net:5200
Targets
-
-
Target
4e72f9068a19d1b59183b5a9a2e8ccedd5b2165fc523828002f8a584d3cada49.exe
-
Size
938KB
-
MD5
7e42d0878d53b209a5e8946c1beacc1b
-
SHA1
9a808ead9c9d878de69a1fe1f18cb7de8a4ac12a
-
SHA256
4e72f9068a19d1b59183b5a9a2e8ccedd5b2165fc523828002f8a584d3cada49
-
SHA512
d83989bb6444a76b2963b95cc29750cbaaa8be694ab3cddd12f8cb9996ad1b4a3c6213a1abb2ae5b6975e82eece9e20c7a2e0362a28e2ad4755e983e9047584a
-
SSDEEP
24576:v5Maj9nvBouda27spxjoBUjdhXxYA7/X:v3L4VfmU
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
ModiLoader Second Stage
-
Warzone RAT payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-