Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    211BB570BD70A89E4680D34451DD3350.exe

  • Size

    908KB

  • Sample

    230708-zd6v4aba3v

  • MD5

    211bb570bd70a89e4680d34451dd3350

  • SHA1

    da743c57a2b1727e3da7cdf8e98b9cba93ecb862

  • SHA256

    cd26009a2cfa0a5f8b8e44786b045b4a0d8faf78ae5ae044a64226f3ced2bda7

  • SHA512

    da76993cf60de3d5edea9de33972409c689eaeb82c2c1afde3fbf4e5b79a2ab476caf127c1999be6b281e31bb7f9f1fe041fdc1e3882a532723dfb7bcd0b3e4d

  • SSDEEP

    24576:xgLzNa28Rcr2O86+6MDUlnEXYfWGOvD7QKM:xgL4HA2/KrJ

Malware Config

Extracted

Family

warzonerat

C2

mywarswarw.ddns.net:5200

Targets

    • Target

      211BB570BD70A89E4680D34451DD3350.exe

    • Size

      908KB

    • MD5

      211bb570bd70a89e4680d34451dd3350

    • SHA1

      da743c57a2b1727e3da7cdf8e98b9cba93ecb862

    • SHA256

      cd26009a2cfa0a5f8b8e44786b045b4a0d8faf78ae5ae044a64226f3ced2bda7

    • SHA512

      da76993cf60de3d5edea9de33972409c689eaeb82c2c1afde3fbf4e5b79a2ab476caf127c1999be6b281e31bb7f9f1fe041fdc1e3882a532723dfb7bcd0b3e4d

    • SSDEEP

      24576:xgLzNa28Rcr2O86+6MDUlnEXYfWGOvD7QKM:xgL4HA2/KrJ

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • ModiLoader Second Stage

    • Warzone RAT payload

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks