Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
211BB570BD70A89E4680D34451DD3350.exe
-
Size
908KB
-
Sample
230708-zd6v4aba3v
-
MD5
211bb570bd70a89e4680d34451dd3350
-
SHA1
da743c57a2b1727e3da7cdf8e98b9cba93ecb862
-
SHA256
cd26009a2cfa0a5f8b8e44786b045b4a0d8faf78ae5ae044a64226f3ced2bda7
-
SHA512
da76993cf60de3d5edea9de33972409c689eaeb82c2c1afde3fbf4e5b79a2ab476caf127c1999be6b281e31bb7f9f1fe041fdc1e3882a532723dfb7bcd0b3e4d
-
SSDEEP
24576:xgLzNa28Rcr2O86+6MDUlnEXYfWGOvD7QKM:xgL4HA2/KrJ
Static task
static1
Behavioral task
behavioral1
Sample
211BB570BD70A89E4680D34451DD3350.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
211BB570BD70A89E4680D34451DD3350.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
warzonerat
mywarswarw.ddns.net:5200
Targets
-
-
Target
211BB570BD70A89E4680D34451DD3350.exe
-
Size
908KB
-
MD5
211bb570bd70a89e4680d34451dd3350
-
SHA1
da743c57a2b1727e3da7cdf8e98b9cba93ecb862
-
SHA256
cd26009a2cfa0a5f8b8e44786b045b4a0d8faf78ae5ae044a64226f3ced2bda7
-
SHA512
da76993cf60de3d5edea9de33972409c689eaeb82c2c1afde3fbf4e5b79a2ab476caf127c1999be6b281e31bb7f9f1fe041fdc1e3882a532723dfb7bcd0b3e4d
-
SSDEEP
24576:xgLzNa28Rcr2O86+6MDUlnEXYfWGOvD7QKM:xgL4HA2/KrJ
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
ModiLoader Second Stage
-
Warzone RAT payload
-
Adds Run key to start application
-