Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679

  • Size

    287KB

  • Sample

    221028-gtcm3sefe7

  • MD5

    7170cc643a9c4b5e35cbff4fdff3a8d7

  • SHA1

    d3395f2ff313f8fae082adad9d9e892b860eb747

  • SHA256

    7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679

  • SHA512

    44662d34c37048a7fee0eb11e05818719a15afd618dfbe809c3eed1a903bd1df07eab1d90540e87390498c6b366a73719e7a1bda75a9d5eb4d712186f4436841

  • SSDEEP

    6144:YVKVvfInUcpUm6KhJPWje13dCVdKrLXoJ8LL:DIUwdWjenCi/X1

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

chinagov.duckdns.org:5202

Targets

    • Target

      7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679

    • Size

      287KB

    • MD5

      7170cc643a9c4b5e35cbff4fdff3a8d7

    • SHA1

      d3395f2ff313f8fae082adad9d9e892b860eb747

    • SHA256

      7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679

    • SHA512

      44662d34c37048a7fee0eb11e05818719a15afd618dfbe809c3eed1a903bd1df07eab1d90540e87390498c6b366a73719e7a1bda75a9d5eb4d712186f4436841

    • SSDEEP

      6144:YVKVvfInUcpUm6KhJPWje13dCVdKrLXoJ8LL:DIUwdWjenCi/X1

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix

Tasks