General
-
Target
Quotation Request Reference Details.exe
-
Size
762KB
-
Sample
230324-r2eshsfb35
-
MD5
9e19382494ab766b05c90cad05588c9b
-
SHA1
6bd85f0c94574fa0f4d27e791c03871dc07776d6
-
SHA256
ab032688523c2d7c7d0c7e829a3761fe59797d0d9b24789c94b7d0a6e5e30c29
-
SHA512
cec2566575b6989166dbcda9fde97a56e7a9e0b21fc656259fb0ae6af77e8b404a336307bcd9492c73d01c883edcc834eceb44cd2167f86a649420214e79604a
-
SSDEEP
12288:JEkDmC7ekQVonF1Wp5j6cG7yXqMiHEVXhsdnfvkGUUmyyi8jXRy2Y36j:aUz4VoF1Wp8c8tMikVXhknfvSUmy4436
Static task
static1
Behavioral task
behavioral1
Sample
Quotation Request Reference Details.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Quotation Request Reference Details.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
warzonerat
delta212.ddns.net:3072
Targets
-
-
Target
Quotation Request Reference Details.exe
-
Size
762KB
-
MD5
9e19382494ab766b05c90cad05588c9b
-
SHA1
6bd85f0c94574fa0f4d27e791c03871dc07776d6
-
SHA256
ab032688523c2d7c7d0c7e829a3761fe59797d0d9b24789c94b7d0a6e5e30c29
-
SHA512
cec2566575b6989166dbcda9fde97a56e7a9e0b21fc656259fb0ae6af77e8b404a336307bcd9492c73d01c883edcc834eceb44cd2167f86a649420214e79604a
-
SSDEEP
12288:JEkDmC7ekQVonF1Wp5j6cG7yXqMiHEVXhsdnfvkGUUmyyi8jXRy2Y36j:aUz4VoF1Wp8c8tMikVXhknfvSUmy4436
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
ModiLoader Second Stage
-
Warzone RAT payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-