General
-
Target
SWIFT New PO LI-2204 (Etd early Septasap).exe
-
Size
990KB
-
Sample
230402-vt9vgahe48
-
MD5
4e0528c2f1f5f636cc72a5e87f891cae
-
SHA1
6a297c89723c4515e1cab4319c078f2ad68bf64e
-
SHA256
30e0958d76246d8347b4b074fb499140b61941f1e94c662adacb0a6497acb2af
-
SHA512
b8cae27f341823ccc847720520d6564cc4c986ac165f05016e580d17beeccba6fb166a091fcf9a6c81dbb5c9479ef39952d2f07a0fce4e58b140ce769d5158d0
-
SSDEEP
12288:uYcH/Ym8m40U1g6LfYdOKMhhLm733R3VoctIRy3+AhSsKySOVgA0klqUUm15dHuh:uRgkwg6LfYdShiDtuUP3l75Shklq0Ch
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT New PO LI-2204 (Etd early Septasap).exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SWIFT New PO LI-2204 (Etd early Septasap).exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
warzonerat
bestsuccess.duckdns.org:2442
Targets
-
-
Target
SWIFT New PO LI-2204 (Etd early Septasap).exe
-
Size
990KB
-
MD5
4e0528c2f1f5f636cc72a5e87f891cae
-
SHA1
6a297c89723c4515e1cab4319c078f2ad68bf64e
-
SHA256
30e0958d76246d8347b4b074fb499140b61941f1e94c662adacb0a6497acb2af
-
SHA512
b8cae27f341823ccc847720520d6564cc4c986ac165f05016e580d17beeccba6fb166a091fcf9a6c81dbb5c9479ef39952d2f07a0fce4e58b140ce769d5158d0
-
SSDEEP
12288:uYcH/Ym8m40U1g6LfYdOKMhhLm733R3VoctIRy3+AhSsKySOVgA0klqUUm15dHuh:uRgkwg6LfYdShiDtuUP3l75Shklq0Ch
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
ModiLoader Second Stage
-
Warzone RAT payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-