General
-
Target
Purchase-Order-20230328-pdf.scr.exe
-
Size
2.3MB
-
Sample
230328-x678hsee5s
-
MD5
44a515d0f88b27b70bfef6dd96c50302
-
SHA1
eb6cae15c7597021e52e34315e82186cd83dd082
-
SHA256
7cae22a41e109496f6ea53a828fea73619c236d3f2bd4ca3030d9ae13649c5ea
-
SHA512
ae4075d08c9300de5ce2d58399ae14f8dbc528e0b0fcd08c021855b098ad57aaba3ae036a62a5525ac6c8c52ddec90bcc09da9443e6533074ae1be39ebfcad1f
-
SSDEEP
24576:udDIxfpCc1vE6Rl5NemKtu1Dze6HDpLD8T5vAlVZnNJnVvgvxKOcP/alv8l2yfa3:qIxBY6pnNpV8GZqClkEHtES1ZsR
Static task
static1
Behavioral task
behavioral1
Sample
Purchase-Order-20230328-pdf.scr.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Purchase-Order-20230328-pdf.scr.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
warzonerat
2.58.47.203:17873
Targets
-
-
Target
Purchase-Order-20230328-pdf.scr.exe
-
Size
2.3MB
-
MD5
44a515d0f88b27b70bfef6dd96c50302
-
SHA1
eb6cae15c7597021e52e34315e82186cd83dd082
-
SHA256
7cae22a41e109496f6ea53a828fea73619c236d3f2bd4ca3030d9ae13649c5ea
-
SHA512
ae4075d08c9300de5ce2d58399ae14f8dbc528e0b0fcd08c021855b098ad57aaba3ae036a62a5525ac6c8c52ddec90bcc09da9443e6533074ae1be39ebfcad1f
-
SSDEEP
24576:udDIxfpCc1vE6Rl5NemKtu1Dze6HDpLD8T5vAlVZnNJnVvgvxKOcP/alv8l2yfa3:qIxBY6pnNpV8GZqClkEHtES1ZsR
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-