warzonerat | A92AE69556CDBD1E759C120F8DFA4942[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
A92AE69556CDBD1E759C120F8DFA4942.exe
Size 132KB
Sample221107-dplteaeda8
SHA256 8bbf01c82d53115249d7861bb2a55b81c85802dd0989f31941e868bc1b515b01
MD5 a92ae69556cdbd1e759c120f8dfa4942
SHA1 06f19339481bdf10e54118c045588d27f22791ad
SHA512 0825ce28b750305a54d3d118b6d68e16795de6edd63635b83f5e6ac66e40580c75edd7dbc6b5f822f6ba9b85d64d175ec2dc62e57d8387be041b1634da4d5528
SSDEEP 3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

176.124.215.147:5200

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

File Explorer

A92AE69556CDBD1E759C120F8DFA4942.exe

.exe 132KB

A92AE69556CDBD1E759C120F8DFA4942.exe

IMPHASH 56fc94e02d7bc310030753938e49a91a
SHA256 8bbf01c82d53115249d7861bb2a55b81c85802dd0989f31941e868bc1b515b01
MD5 a92ae69556cdbd1e759c120f8dfa4942
SHA1 06f19339481bdf10e54118c045588d27f22791ad
SHA512 0825ce28b750305a54d3d118b6d68e16795de6edd63635b83f5e6ac66e40580c75edd7dbc6b5f822f6ba9b85d64d175ec2dc62e57d8387be041b1634da4d5528
SSDEEP 3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT payload

rat

Minor OS version

Major OS version

Entry point

28068

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

webservices

WsFileTimeToDateTime

bcrypt

BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt

kernel32

lstrcpyW GetTickCount HeapAlloc GetProcessHeap GetCommandLineA GetStartupInfoA HeapFree VirtualAlloc HeapReAlloc VirtualQuery LocalAlloc LocalFree SystemTimeToFileTime TerminateThread CreateThread WriteProcessMemory GetCurrentProcess OpenProcess GetWindowsDirectoryA VirtualProtectEx VirtualAllocEx CreateRemoteThread GetModuleHandleW IsWow64Process WriteFile CreateFileW LoadLibraryW GetLocalTime GetCurrentThreadId GetCurrentProcessId ReadFile FindFirstFileA GetBinaryTypeW FindNextFileA GetFullPathNameA CreateFileA GlobalAlloc GetCurrentDirectoryW lstrcmpA GetFileSize FreeLibrary SetDllDirectoryW GetFileSizeEx WaitForSingleObject WaitForMultipleObjects CreatePipe PeekNamedPipe DuplicateHandle SetEvent CreateProcessW CreateEventA GetModuleFileNameW WideCharToMultiByte LoadResource FindResourceW GetComputerNameW GlobalMemoryStatusEx LoadLibraryExW FindFirstFileW FindNextFileW SetFilePointer GetLogicalDriveStringsW CopyFileW GetDriveTypeW EnterCriticalSection LeaveCriticalSection lstrlenA DeleteCriticalSection CreateMutexA ReleaseMutex TerminateProcess K32GetModuleFileNameExW CreateToolhelp32Snapshot Process32NextW Process32FirstW DeleteFileW SizeofResource VirtualProtect GetSystemDirectoryW LockResource GetWindowsDirectoryW Process32First Process32Next GetTempPathA ExpandEnvironmentStringsW lstrlenW lstrcmpW CreateProcessA WinExec ExitProcess GetProcAddress lstrcpyA CloseHandle lstrcatW LoadLibraryA GetLastError GetPrivateProfileStringW GetModuleHandleA GetTempPathW VirtualFree SetLastError Sleep GetModuleFileNameA CreateDirectoryW MultiByteToWideChar lstrcatA SetCurrentDirectoryW InitializeCriticalSection

user32

GetKeyState GetMessageA DispatchMessageA CreateWindowExW CallNextHookEx GetAsyncKeyState RegisterClassW GetRawInputData MapVirtualKeyA DefWindowProcA RegisterRawInputDevices TranslateMessage ToUnicode wsprintfW PostQuitMessage GetLastInputInfo GetForegroundWindow GetWindowTextW wsprintfA GetKeyNameTextW CharLowerW

advapi32

RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid LookupAccountSidW RegCreateKeyExW RegDeleteKeyW InitializeSecurityDescriptor RegDeleteKeyA SetSecurityDescriptorDacl RegQueryValueExW RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegQueryValueExA RegQueryInfoKeyW RegCloseKey OpenServiceW ChangeServiceConfigW QueryServiceConfigW EnumServicesStatusExW StartServiceW RegSetValueExW RegCreateKeyExA OpenSCManagerW CloseServiceHandle GetTokenInformation RegSetValueExA

shell32

SHGetFolderPathW ShellExecuteExA ord680 SHGetKnownFolderPath SHFileOperationW SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW

urlmon

URLDownloadToFileW

ws2_32

getaddrinfo setsockopt freeaddrinfo htons recv socket send WSAConnect WSAStartup shutdown closesocket WSACleanup connect InetNtopW gethostbyname inet_addr

ole32

CoCreateInstance CoInitialize CoTaskMemFree CoUninitialize CoInitializeSecurity

shlwapi

StrStrW PathFindExtensionW PathCombineA PathFindFileNameW StrStrA PathRemoveFileSpecA PathFileExistsW

netapi32

NetUserAdd NetLocalGroupAddMembers

oleaut32

VariantInit

crypt32

CryptUnprotectData CryptStringToBinaryA CryptStringToBinaryW

wininet

InternetTimeToSystemTimeA