General
-
Target
PO82734-736CTC21022008210.exe
-
Size
665KB
-
Sample
230324-qphg7sgf6t
-
MD5
11cd657c254419a8c8ef767933aecaf4
-
SHA1
7d8ff5a09d4d9036d023b05ed5ecb54ff466d7a5
-
SHA256
01eec7722840af58f30e5f24fa5820a75cb3d5eb4691b0e163b3a9d3e057ec52
-
SHA512
4842c70e44afe761b8e6ce556f79c8f1df202c95b3a0acdf2ae4dd75274b1bd562eb51d2ffab69c6a1d4a657230afba2a46969a7e0833676f72aedcccc42666c
-
SSDEEP
12288:FEMabC8uxlpPYZcQbLcopr+R1UhLmmK5hCjhVzwUfNO1OpX36jM:6M+PklOZVbLc2rW+LIiTzwJG36A
Static task
static1
Behavioral task
behavioral1
Sample
PO82734-736CTC21022008210.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PO82734-736CTC21022008210.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
warzonerat
delta212.ddns.net:3072
Targets
-
-
Target
PO82734-736CTC21022008210.exe
-
Size
665KB
-
MD5
11cd657c254419a8c8ef767933aecaf4
-
SHA1
7d8ff5a09d4d9036d023b05ed5ecb54ff466d7a5
-
SHA256
01eec7722840af58f30e5f24fa5820a75cb3d5eb4691b0e163b3a9d3e057ec52
-
SHA512
4842c70e44afe761b8e6ce556f79c8f1df202c95b3a0acdf2ae4dd75274b1bd562eb51d2ffab69c6a1d4a657230afba2a46969a7e0833676f72aedcccc42666c
-
SSDEEP
12288:FEMabC8uxlpPYZcQbLcopr+R1UhLmmK5hCjhVzwUfNO1OpX36jM:6M+PklOZVbLc2rW+LIiTzwJG36A
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
ModiLoader Second Stage
-
Warzone RAT payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-