Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
03344799.exe
-
Size
26KB
-
Sample
230613-n1ejksga46
-
MD5
f97dd898670874b524df23d89dc6a12f
-
SHA1
98b76fd8b13e66e73215fc6f1f3b1d510d0d504d
-
SHA256
841fc466a01841b07d66a4e99f2695592f9fc02c7bd24e5f3d74259a345d5110
-
SHA512
0e82501494b30e88b82ee0291e56b132a0615800d4bce3a031f06a34b7b0e9ef9a89c18648e9b4c70be460089f429b6052b5aac306ad979278e276a3c1308515
-
SSDEEP
384:/T1sZrG2iPQWRErIYib+W42KKxPxh8E9VF0Ny5dF:/BsZa2mf+UYib+WnxPxWEj
Static task
static1
Behavioral task
behavioral1
Sample
03344799.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
03344799.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
warzonerat
testing1212.ddns.net:5201
Targets
-
-
Target
03344799.exe
-
Size
26KB
-
MD5
f97dd898670874b524df23d89dc6a12f
-
SHA1
98b76fd8b13e66e73215fc6f1f3b1d510d0d504d
-
SHA256
841fc466a01841b07d66a4e99f2695592f9fc02c7bd24e5f3d74259a345d5110
-
SHA512
0e82501494b30e88b82ee0291e56b132a0615800d4bce3a031f06a34b7b0e9ef9a89c18648e9b4c70be460089f429b6052b5aac306ad979278e276a3c1308515
-
SSDEEP
384:/T1sZrG2iPQWRErIYib+W42KKxPxh8E9VF0Ny5dF:/BsZa2mf+UYib+WnxPxWEj
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-