General
-
Target
44a515d0f88b27b70bfef6dd96c50302.bin
-
Size
1.0MB
-
Sample
230330-bpph7acb5s
-
MD5
05794e92be835652c189553e78e912f3
-
SHA1
5274380e96a32b7398587a1e604f839af280d097
-
SHA256
7c814584ed1265c5680d7143ed9dfc57c93a25a76eb8735d080eb727be5bc1a6
-
SHA512
f580dc2f8bb7316a9c92e66a4c527fcea40257bde2b48cd8c8ea9acd4b792343053300a06135cfd2ebcdccfcb2d9bf26132e33314d0510f7f09151d6892abe14
-
SSDEEP
24576:IThAiOC4dtwoJ2R3zQau88ThAA1MyDstq4j9qc/C:ITe5C4dtwoJo3zQWMAA1MygZF/C
Static task
static1
Behavioral task
behavioral1
Sample
7cae22a41e109496f6ea53a828fea73619c236d3f2bd4ca3030d9ae13649c5ea.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7cae22a41e109496f6ea53a828fea73619c236d3f2bd4ca3030d9ae13649c5ea.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
warzonerat
2.58.47.203:17873
Targets
-
-
Target
7cae22a41e109496f6ea53a828fea73619c236d3f2bd4ca3030d9ae13649c5ea.exe
-
Size
2.3MB
-
MD5
44a515d0f88b27b70bfef6dd96c50302
-
SHA1
eb6cae15c7597021e52e34315e82186cd83dd082
-
SHA256
7cae22a41e109496f6ea53a828fea73619c236d3f2bd4ca3030d9ae13649c5ea
-
SHA512
ae4075d08c9300de5ce2d58399ae14f8dbc528e0b0fcd08c021855b098ad57aaba3ae036a62a5525ac6c8c52ddec90bcc09da9443e6533074ae1be39ebfcad1f
-
SSDEEP
24576:udDIxfpCc1vE6Rl5NemKtu1Dze6HDpLD8T5vAlVZnNJnVvgvxKOcP/alv8l2yfa3:qIxBY6pnNpV8GZqClkEHtES1ZsR
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-