Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    03344799.exe

  • Size

    26KB

  • Sample

    230613-n1ejksga46

  • MD5

    f97dd898670874b524df23d89dc6a12f

  • SHA1

    98b76fd8b13e66e73215fc6f1f3b1d510d0d504d

  • SHA256

    841fc466a01841b07d66a4e99f2695592f9fc02c7bd24e5f3d74259a345d5110

  • SHA512

    0e82501494b30e88b82ee0291e56b132a0615800d4bce3a031f06a34b7b0e9ef9a89c18648e9b4c70be460089f429b6052b5aac306ad979278e276a3c1308515

  • SSDEEP

    384:/T1sZrG2iPQWRErIYib+W42KKxPxh8E9VF0Ny5dF:/BsZa2mf+UYib+WnxPxWEj

Malware Config

Extracted

Family

warzonerat

C2

testing1212.ddns.net:5201

Targets

    • Target

      03344799.exe

    • Size

      26KB

    • MD5

      f97dd898670874b524df23d89dc6a12f

    • SHA1

      98b76fd8b13e66e73215fc6f1f3b1d510d0d504d

    • SHA256

      841fc466a01841b07d66a4e99f2695592f9fc02c7bd24e5f3d74259a345d5110

    • SHA512

      0e82501494b30e88b82ee0291e56b132a0615800d4bce3a031f06a34b7b0e9ef9a89c18648e9b4c70be460089f429b6052b5aac306ad979278e276a3c1308515

    • SSDEEP

      384:/T1sZrG2iPQWRErIYib+W42KKxPxh8E9VF0Ny5dF:/BsZa2mf+UYib+WnxPxWEj

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks