General
-
Target
SecuriteInfo.com.W32.Injector.ESFN.tr.21849.22345.exe
-
Size
813KB
-
Sample
221123-d23bxsde7t
-
MD5
96687cb64b98418c573ee65753a72e33
-
SHA1
d20ada54342596cd29bf7f66bc86d4503c4cfea4
-
SHA256
c410af32a481222f15dd9babe626182317e7d76d603d2eb001cccd213a258873
-
SHA512
b9f4e51985e839ece1f1bfb74ce1c0ffa232f848cdbef5a1c65ed3e703096074b779b509c1369060a96e924d4eae7e80049639e886923271b4d576ca725746b9
-
SSDEEP
12288:vOrAkZrlpZxc3NKqgw9ONuRJooNN5dHVqTdTB2O4rwSMpxwhxjgV:vs3hp4c6/n5q5oOqLM2x0V
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.Injector.ESFN.tr.21849.22345.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.Injector.ESFN.tr.21849.22345.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
https://drive.google.com/uc?export=download&id=1Dbjqv3kYu9z-oWAyCtOblfNRuOjXFyFa
Extracted
warzonerat
nightmare4666.ddns.net:2442
Targets
-
-
Target
SecuriteInfo.com.W32.Injector.ESFN.tr.21849.22345.exe
-
Size
813KB
-
MD5
96687cb64b98418c573ee65753a72e33
-
SHA1
d20ada54342596cd29bf7f66bc86d4503c4cfea4
-
SHA256
c410af32a481222f15dd9babe626182317e7d76d603d2eb001cccd213a258873
-
SHA512
b9f4e51985e839ece1f1bfb74ce1c0ffa232f848cdbef5a1c65ed3e703096074b779b509c1369060a96e924d4eae7e80049639e886923271b4d576ca725746b9
-
SSDEEP
12288:vOrAkZrlpZxc3NKqgw9ONuRJooNN5dHVqTdTB2O4rwSMpxwhxjgV:vs3hp4c6/n5q5oOqLM2x0V
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
ModiLoader Second Stage
-
Warzone RAT payload
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-