warzonerat | 768-187-0x0000000000400000-0x0000000000568000-memory[.]dmp

General

Target
768-187-0x0000000000400000-0x0000000000568000-memory.dmp
Size 1.4MB
Sample230329-jb7rlsfc39
SHA256 a2dc788490acdd8c8d1937929a025b51fa6cbbd6acccb08e6960ec045eab0442
MD5 9176911e8717ca3f04e3ee15fa18a5ac
SHA1 de343dde0d131f2b31573844ce8398c948419d10
SHA512 2be967acdf2bd25c2d5d7b3e5f6bd7f42995f3e233b0151cf09a9348a450001997b74a0f59cba147fff15bf557cc5f95ecbfa78cc22c10d74d0041a1c6d0cf6d
SSDEEP 3072:WzPtbXqn6aR97tie5Niae2vl23G3Fzyffz8LTDh:Wz1bXq6aR97ViJ2vlz9yffz8LT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

C2

peggyboo.duckdns.org:4545

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

File Explorer

768-187-0x0000000000400000-0x0000000000568000-memory.dmp

.exe 1.4MB

768-187-0x0000000000400000-0x0000000000568000-memory.dmp

SHA256 a2dc788490acdd8c8d1937929a025b51fa6cbbd6acccb08e6960ec045eab0442
MD5 9176911e8717ca3f04e3ee15fa18a5ac
SHA1 de343dde0d131f2b31573844ce8398c948419d10
SHA512 2be967acdf2bd25c2d5d7b3e5f6bd7f42995f3e233b0151cf09a9348a450001997b74a0f59cba147fff15bf557cc5f95ecbfa78cc22c10d74d0041a1c6d0cf6d
SSDEEP 3072:WzPtbXqn6aR97tie5Niae2vl23G3Fzyffz8LTDh:Wz1bXq6aR97ViJ2vlz9yffz8LT
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT payload

rat

Minor OS version

Major OS version

Entry point

46422

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing