General
-
Target
0aa2bc2db95a3ae6bee14c0cfc0d59b7.bin
-
Size
80KB
-
Sample
230330-bct8xaae26
-
MD5
9fc0d624f0b2a133d6d42135c6d744cc
-
SHA1
36ceec6d6a6f379676acbdc8ec0fc67b478dd89a
-
SHA256
ea4f7a4097b3746b82134bc23fad3a075443af2476c83f3cef878a651430fa59
-
SHA512
e04dd07e9d5ed8bbc2059339e8fb444553b31acd8e2e1f07affa97e2514903a3ea4f7409a6619d158a84df9559ae5b18ed8b99d86f50cbd50be1146d6829c887
-
SSDEEP
1536:Tyf3NvKSxYarNh3znXIRgeofF8ISjyDesKm4ACsPIQbGGWtGbBKrawx6ZAui:T2XYWNVXIRI98IXDFpSG9BKrawY9i
Behavioral task
behavioral1
Sample
fc3961ba7ba25c5d3da95cbe89f31051c8faba436297895ec65b24aebca93753.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fc3961ba7ba25c5d3da95cbe89f31051c8faba436297895ec65b24aebca93753.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
warzonerat
dgorijan20785.hopto.org:5200
Targets
-
-
Target
fc3961ba7ba25c5d3da95cbe89f31051c8faba436297895ec65b24aebca93753.exe
-
Size
189KB
-
MD5
0aa2bc2db95a3ae6bee14c0cfc0d59b7
-
SHA1
557024bce74469c84b12ae76fa741317a8e97d5a
-
SHA256
fc3961ba7ba25c5d3da95cbe89f31051c8faba436297895ec65b24aebca93753
-
SHA512
1fc3bc593e2d2acb7be08e20f716d67c3c2da32cf1dc637e051d647b294690eb0428e638209057fe2be02398113373e26146965fdb91e32c60b2e50a94b2c458
-
SSDEEP
3072:WzPtbXqn6aR97tie5Niae2vl23G3Fzyffz8LTDh:Wz1bXq6aR97ViJ2vlz9yffz8LT
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-