General
-
Target
3650e941f589db93a518d602e4b0ddd9a54c7c42f3d1d06bdda467651cbb95f7
-
Size
328KB
-
Sample
221206-qdrlqsbb46
-
MD5
33cfde0badba18cca2d44476d7d45edc
-
SHA1
290003e3266acffa2e669e50ff0aad8f3974b214
-
SHA256
3650e941f589db93a518d602e4b0ddd9a54c7c42f3d1d06bdda467651cbb95f7
-
SHA512
9ee920f4b040d54b48bd80bf1cf29a9ce8572fbf75c737f55fdf8fc7127b63d900e3690af85124b40593e1a30142bce7235c8df025c7e1ec71f97e8cf4478dc5
-
SSDEEP
6144:PBnxm/hZudIIuLpZPP5ZW757lLRmNAIOVn:LzdIZpZPcVmNPG
Static task
static1
Behavioral task
behavioral1
Sample
3650e941f589db93a518d602e4b0ddd9a54c7c42f3d1d06bdda467651cbb95f7.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
warzonerat
baramac.duckdns.org:6269
Targets
-
-
Target
3650e941f589db93a518d602e4b0ddd9a54c7c42f3d1d06bdda467651cbb95f7
-
Size
328KB
-
MD5
33cfde0badba18cca2d44476d7d45edc
-
SHA1
290003e3266acffa2e669e50ff0aad8f3974b214
-
SHA256
3650e941f589db93a518d602e4b0ddd9a54c7c42f3d1d06bdda467651cbb95f7
-
SHA512
9ee920f4b040d54b48bd80bf1cf29a9ce8572fbf75c737f55fdf8fc7127b63d900e3690af85124b40593e1a30142bce7235c8df025c7e1ec71f97e8cf4478dc5
-
SSDEEP
6144:PBnxm/hZudIIuLpZPP5ZW757lLRmNAIOVn:LzdIZpZPcVmNPG
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-