warzonerat | 0a4f85cf4998d6ef59e135a36f0f0045[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
0a4f85cf4998d6ef59e135a36f0f0045.bin
Size 74KB
Sample230611-be22jagh7t
SHA256 45e8c8d8dcce0fadc11ea9b6e859d75331c76316cfea54e21361b3e9938cf33a
MD5 18192f9ef56fa578ae62ab713cd5f687
SHA1 000f79d5959777455f34ea307f2eee8471cc7326
SHA512 f37832f5b334709765061117689b40184f94748bfe92eac6194b323111fbe221b14d807451156587c381133cedea15e29ff08934efdcc7e8ca97465242b28333
SSDEEP 1536:2EFmLTxcarEp9qp20FbyY0ITUB9NPB0hV8mUjTWxiByissYYF:2EFgrV8QmrIGZ0kmUWxiBx9F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

193.161.193.99:48883

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
static1/unpack001/af2c70c1898d6c26e7c6b1de3b522fac248e11eb9889230c52fa385c8a2fd3db.exe	warzonerat

Warzonerat family
warzonerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/af2c70c1898d6c26e7c6b1de3b522fac248e11eb9889230c52fa385c8a2fd3db.exe

File Explorer

0a4f85cf4998d6ef59e135a36f0f0045.bin

.zip 74KB
af2c70c1898d6c26e7c6b1de3b522fac248e11eb9889230c52fa385c8a2fd3db.exe

.exe 141KB

0a4f85cf4998d6ef59e135a36f0f0045.bin

SHA256 45e8c8d8dcce0fadc11ea9b6e859d75331c76316cfea54e21361b3e9938cf33a
MD5 18192f9ef56fa578ae62ab713cd5f687
SHA1 000f79d5959777455f34ea307f2eee8471cc7326
SHA512 f37832f5b334709765061117689b40184f94748bfe92eac6194b323111fbe221b14d807451156587c381133cedea15e29ff08934efdcc7e8ca97465242b28333
SSDEEP 1536:2EFmLTxcarEp9qp20FbyY0ITUB9NPB0hV8mUjTWxiByissYYF:2EFgrV8QmrIGZ0kmUWxiBx9F
MD5 SHA1 SHA512 SSDEEP

Password

infected

af2c70c1898d6c26e7c6b1de3b522fac248e11eb9889230c52fa385c8a2fd3db.exe

IMPHASH 0145d2c473bdbcd7b46a054bd6893ec4
SHA256 af2c70c1898d6c26e7c6b1de3b522fac248e11eb9889230c52fa385c8a2fd3db
MD5 0a4f85cf4998d6ef59e135a36f0f0045
SHA1 0ab91147cb53cdfa293641c4c43fcaa61c26ad81
SHA512 7b826439321a9bc653ec4e31ed30666777153a933c0a03c74d0cf12c8cfeb8b92da9f7b5e8e34862e0f58bfcf59969bdfa37f5758e6d623a053eaec11631a26b
SSDEEP 3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

26526

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

waveInClose waveInAddBuffer waveInStart waveInStop waveInPrepareHeader waveInUnprepareHeader waveInOpen

webservices

WsFileTimeToDateTime

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt

kernel32

GetTickCount HeapAlloc GetProcessHeap GetCommandLineA GetStartupInfoA HeapFree VirtualAlloc HeapReAlloc VirtualQuery LocalAlloc LocalFree SystemTimeToFileTime TerminateThread CreateThread WriteProcessMemory GetCurrentProcess OpenProcess GetWindowsDirectoryA VirtualProtectEx VirtualAllocEx CreateRemoteThread GetModuleHandleW IsWow64Process WriteFile WaitForSingleObject CreateFileW LoadLibraryW GetLocalTime GetCurrentThreadId GetCurrentProcessId ReadFile FindFirstFileA GetBinaryTypeW FindNextFileA lstrcpyW CreateFileA GlobalAlloc GetCurrentDirectoryW SetCurrentDirectoryW GetFileSize FreeLibrary SetDllDirectoryW GetFileSizeEx WaitForMultipleObjects CreatePipe PeekNamedPipe DuplicateHandle SetEvent CreateProcessW CreateEventA GetModuleFileNameW LoadResource FindResourceW GetComputerNameW GlobalMemoryStatusEx LoadLibraryExW FindFirstFileW FindNextFileW SetFilePointer GetLogicalDriveStringsW CopyFileW GetDriveTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateMutexA ReleaseMutex TerminateProcess K32GetModuleFileNameExW CreateToolhelp32Snapshot Process32NextW Process32FirstW DeleteFileW SizeofResource VirtualProtect GetSystemDirectoryW LockResource GetWindowsDirectoryW GlobalLock GlobalUnlock Process32First Process32Next WideCharToMultiByte lstrcpyA Sleep MultiByteToWideChar lstrcatA lstrcmpA lstrlenA ExpandEnvironmentStringsW lstrlenW lstrcmpW CreateProcessA WinExec ExitProcess GetProcAddress CloseHandle lstrcatW LoadLibraryA GetLastError GetPrivateProfileStringW GetModuleHandleA GetTempPathW VirtualFree SetLastError GetModuleFileNameA CreateDirectoryW GetFullPathNameA

user32

GetWindowTextW GetLastInputInfo wsprintfW CharLowerW PostQuitMessage ToUnicode TranslateMessage RegisterRawInputDevices DefWindowProcA MapVirtualKeyA GetRawInputData RegisterClassW GetAsyncKeyState GetKeyboardState CreateWindowExW SetClipboardViewer DispatchMessageA MapVirtualKeyW GetMessageA GetKeyState ReleaseDC GetSystemMetrics GetForegroundWindow OpenClipboard CloseClipboard GetClipboardData GetDC

advapi32

RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid LookupAccountSidW GetTokenInformation RegQueryInfoKeyA RegOpenKeyW CloseServiceHandle SetSecurityDescriptorDacl RegDeleteKeyA InitializeSecurityDescriptor GetUserNameW RegDeleteKeyW RegCreateKeyExW RegSetValueExA RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegQueryValueExA RegQueryInfoKeyW RegCloseKey OpenServiceW ChangeServiceConfigW QueryServiceConfigW EnumServicesStatusExW StartServiceW RegSetValueExW RegCreateKeyExA OpenSCManagerW RegDeleteValueW

shell32

SHFileOperationW SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetFolderPathW ShellExecuteW ord680 SHGetKnownFolderPath

urlmon

URLDownloadToFileW

gdiplus

GdiplusStartup GdipGetImageEncoders GdipSaveImageToFile GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdiplusShutdown

ws2_32

WSAConnect WSAStartup shutdown closesocket WSACleanup connect InetNtopW gethostbyname send socket recv htons freeaddrinfo setsockopt getaddrinfo inet_addr

ole32

CreateStreamOnHGlobal CoInitialize CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeSecurity

shlwapi

AssocQueryStringW StrStrW PathRemoveFileSpecA PathCombineA PathFindFileNameW PathFindExtensionW PathFileExistsW StrStrA

netapi32

NetUserAdd NetApiBufferFree NetUserGetInfo NetLocalGroupAddMembers

oleaut32

VariantInit

crypt32

CryptStringToBinaryW CryptStringToBinaryA CryptUnprotectData

wininet

InternetTimeToSystemTimeA

gdi32

CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteObject