General
-
Target
nht-refund...exe
-
Size
579KB
-
Sample
230320-cvfnxade5v
-
MD5
6ca65058e490b038710bd1e2ac8cb457
-
SHA1
c66ea296401994d1d352b2795b70dd38f7eb4f88
-
SHA256
f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b
-
SHA512
f3f473a6e7335b39cdd212ce287070e2f092cc550bd836ca66808b3483ef48c6152ad41a5f9a120c22c268af3960768b6fb7e03a8861bf444052c7cf1476229f
-
SSDEEP
12288:sctmABdVLhcA9D/4BjCAYEKRkx/yX0chSSuPA:sqdpkBtqoaXLMS+
Static task
static1
Behavioral task
behavioral1
Sample
nht-refund...exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
nht-refund...exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
warzonerat
154.16.106.40:4441
Targets
-
-
Target
nht-refund...exe
-
Size
579KB
-
MD5
6ca65058e490b038710bd1e2ac8cb457
-
SHA1
c66ea296401994d1d352b2795b70dd38f7eb4f88
-
SHA256
f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b
-
SHA512
f3f473a6e7335b39cdd212ce287070e2f092cc550bd836ca66808b3483ef48c6152ad41a5f9a120c22c268af3960768b6fb7e03a8861bf444052c7cf1476229f
-
SSDEEP
12288:sctmABdVLhcA9D/4BjCAYEKRkx/yX0chSSuPA:sqdpkBtqoaXLMS+
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-