General
-
Target
AftaAdvancedLesson-main.zip
-
Size
79KB
-
Sample
221207-henmgada75
-
MD5
bd310e007457e2b3b98f69e32236f2d7
-
SHA1
5da5fb41450d7017c1987372aac02e4d10d9ddef
-
SHA256
3e5e38fb2837ef7e4ebb6e19cdc804f517b725244a2c07e3135448b609601351
-
SHA512
4a718db95b22737bb0baecf2b3177d9a4f3be3bc1554c96e2a72d9a4bbb5a71a8fd330d65a7d4a9b4fca70d429d162411bf7588053bdb7841c7735ddfb77eeb8
-
SSDEEP
1536:Jiya3XWQ7gXEZTFBqUOhr/mXGar41qpeNEONmkb2Yq7AQ02rB1q:JN6/kX2TVOC74QpeNEONbak67q
Behavioral task
behavioral1
Sample
AftaAdvancedLesson-main/windll32.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
AftaAdvancedLesson-main/windll32.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
warzonerat
162.55.126.123:1111
Targets
-
-
Target
AftaAdvancedLesson-main/windll32.exe
-
Size
144KB
-
MD5
64fac32b120e4ff32d2b630b034475be
-
SHA1
081605cd23a89a864fa4e4e16f00329cd9cdfc10
-
SHA256
5e47be22f5e470990084884a07f41c0f997c24ae37b26d8f41b01776bbc6588b
-
SHA512
e5febfd95602f42431ed03df46387ba95324b20f8fadb32b2fe9cfbf8ae1b740e7e6cdd3ed78db08e0ea58b9d3bfd915a0cb863cf570ce2c75ff80986a33b768
-
SSDEEP
3072:F7W9jps0Tx4azG6GweOTir5axbjNCz45LT7auXkP0N:FwpsERzGKurEXCzeLT7auX1N
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-