General
-
Target
0aa2bc2db95a3ae6bee14c0cfc0d59b7.exe
-
Size
189KB
-
Sample
230328-xh2qtscf42
-
MD5
0aa2bc2db95a3ae6bee14c0cfc0d59b7
-
SHA1
557024bce74469c84b12ae76fa741317a8e97d5a
-
SHA256
fc3961ba7ba25c5d3da95cbe89f31051c8faba436297895ec65b24aebca93753
-
SHA512
1fc3bc593e2d2acb7be08e20f716d67c3c2da32cf1dc637e051d647b294690eb0428e638209057fe2be02398113373e26146965fdb91e32c60b2e50a94b2c458
-
SSDEEP
3072:WzPtbXqn6aR97tie5Niae2vl23G3Fzyffz8LTDh:Wz1bXq6aR97ViJ2vlz9yffz8LT
Behavioral task
behavioral1
Sample
0aa2bc2db95a3ae6bee14c0cfc0d59b7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0aa2bc2db95a3ae6bee14c0cfc0d59b7.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
warzonerat
dgorijan20785.hopto.org:5200
Targets
-
-
Target
0aa2bc2db95a3ae6bee14c0cfc0d59b7.exe
-
Size
189KB
-
MD5
0aa2bc2db95a3ae6bee14c0cfc0d59b7
-
SHA1
557024bce74469c84b12ae76fa741317a8e97d5a
-
SHA256
fc3961ba7ba25c5d3da95cbe89f31051c8faba436297895ec65b24aebca93753
-
SHA512
1fc3bc593e2d2acb7be08e20f716d67c3c2da32cf1dc637e051d647b294690eb0428e638209057fe2be02398113373e26146965fdb91e32c60b2e50a94b2c458
-
SSDEEP
3072:WzPtbXqn6aR97tie5Niae2vl23G3Fzyffz8LTDh:Wz1bXq6aR97ViJ2vlz9yffz8LT
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-