Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679
-
Size
287KB
-
Sample
221028-gtcm3sefe7
-
MD5
7170cc643a9c4b5e35cbff4fdff3a8d7
-
SHA1
d3395f2ff313f8fae082adad9d9e892b860eb747
-
SHA256
7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679
-
SHA512
44662d34c37048a7fee0eb11e05818719a15afd618dfbe809c3eed1a903bd1df07eab1d90540e87390498c6b366a73719e7a1bda75a9d5eb4d712186f4436841
-
SSDEEP
6144:YVKVvfInUcpUm6KhJPWje13dCVdKrLXoJ8LL:DIUwdWjenCi/X1
Static task
static1
Behavioral task
behavioral1
Sample
7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679.exe
Resource
win10-20220812-en
Malware Config
Extracted
warzonerat
chinagov.duckdns.org:5202
Targets
-
-
Target
7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679
-
Size
287KB
-
MD5
7170cc643a9c4b5e35cbff4fdff3a8d7
-
SHA1
d3395f2ff313f8fae082adad9d9e892b860eb747
-
SHA256
7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679
-
SHA512
44662d34c37048a7fee0eb11e05818719a15afd618dfbe809c3eed1a903bd1df07eab1d90540e87390498c6b366a73719e7a1bda75a9d5eb4d712186f4436841
-
SSDEEP
6144:YVKVvfInUcpUm6KhJPWje13dCVdKrLXoJ8LL:DIUwdWjenCi/X1
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Drops startup file
-
Suspicious use of SetThreadContext
-