Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    windows7.exe

  • Size

    113KB

  • Sample

    230627-kntwysde65

  • MD5

    8c5693544eefeef29423f20b3b2abaf8

  • SHA1

    67bfe01d75d1dc6f952089f2872f51dd02803bdc

  • SHA256

    617dfa640a93ce037bbcbe9bf4106cc9c9ea2049020f131afa500fe0c2630d73

  • SHA512

    1d627ce12f9e4a9405154edf6671dcedcc71714a774e1c8bab8c61cdd6f82775706b819f68147ef8dc2bc58284d05d64de1579779583d9b1ed5773a4df03d21b

  • SSDEEP

    1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0

Malware Config

Extracted

Family

warzonerat

C2

cowboyd.ddns.net:2404

Targets

    • Target

      windows7.exe

    • Size

      113KB

    • MD5

      8c5693544eefeef29423f20b3b2abaf8

    • SHA1

      67bfe01d75d1dc6f952089f2872f51dd02803bdc

    • SHA256

      617dfa640a93ce037bbcbe9bf4106cc9c9ea2049020f131afa500fe0c2630d73

    • SHA512

      1d627ce12f9e4a9405154edf6671dcedcc71714a774e1c8bab8c61cdd6f82775706b819f68147ef8dc2bc58284d05d64de1579779583d9b1ed5773a4df03d21b

    • SSDEEP

      1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks