General
-
Target
4e0528c2f1f5f636cc72a5e87f891cae.bin
-
Size
462KB
-
Sample
230404-brcx6sea2v
-
MD5
ce3751ed9a85749573bdcab69d1934c0
-
SHA1
c592daf65aca0c5ac9b29be4925b8a74f71c98c5
-
SHA256
9ccf7c44106248ec31f5e2a8162cbcae1d0bcdc4e31889247825ca74fa2f408a
-
SHA512
8f2cb4feb63c59ce5d3b845b9b8d69c7a04d7ce6d52671e4e846cb346791da438c198a39a98deca39a3b3a2db796a2b5e6c74449a3ad921a9cbddfba03585bbc
-
SSDEEP
12288:AURkidxfawPc4if8bWNYB9MNK7lVkTx62CH:JXb03yWS9MNK7fkd62CH
Static task
static1
Behavioral task
behavioral1
Sample
30e0958d76246d8347b4b074fb499140b61941f1e94c662adacb0a6497acb2af.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
30e0958d76246d8347b4b074fb499140b61941f1e94c662adacb0a6497acb2af.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
warzonerat
bestsuccess.duckdns.org:2442
Targets
-
-
Target
30e0958d76246d8347b4b074fb499140b61941f1e94c662adacb0a6497acb2af.exe
-
Size
990KB
-
MD5
4e0528c2f1f5f636cc72a5e87f891cae
-
SHA1
6a297c89723c4515e1cab4319c078f2ad68bf64e
-
SHA256
30e0958d76246d8347b4b074fb499140b61941f1e94c662adacb0a6497acb2af
-
SHA512
b8cae27f341823ccc847720520d6564cc4c986ac165f05016e580d17beeccba6fb166a091fcf9a6c81dbb5c9479ef39952d2f07a0fce4e58b140ce769d5158d0
-
SSDEEP
12288:uYcH/Ym8m40U1g6LfYdOKMhhLm733R3VoctIRy3+AhSsKySOVgA0klqUUm15dHuh:uRgkwg6LfYdShiDtuUP3l75Shklq0Ch
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
ModiLoader Second Stage
-
Warzone RAT payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-