Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Reservation.exe
-
Size
203KB
-
Sample
230802-pc573aef29
-
MD5
c3d2671ab969fd347e6e0b81c777fc48
-
SHA1
43d9902d2a7b0583be43ef8d4023c81e9a776e52
-
SHA256
02ef992b9a587c6cdc382995b5dcfff0367554ec581a6fa28d08c70444f9e0d9
-
SHA512
588524f48b47f32b1d412a43a3f376bcfd717db8d8a74c85bf4823c1af51ccbffbd76579544620587c84e2fea1e7ede4e2d361fb348758d8572ee7345eccfc07
-
SSDEEP
6144:/Ya66WOW6k4nLUfQzcGg6Zwaidc8J1CQC:/YgWOE4EQIhairI
Static task
static1
Behavioral task
behavioral1
Sample
Reservation.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Reservation.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
warzonerat
plazzasecretballeronline.onedumb.com:14977
Targets
-
-
Target
Reservation.exe
-
Size
203KB
-
MD5
c3d2671ab969fd347e6e0b81c777fc48
-
SHA1
43d9902d2a7b0583be43ef8d4023c81e9a776e52
-
SHA256
02ef992b9a587c6cdc382995b5dcfff0367554ec581a6fa28d08c70444f9e0d9
-
SHA512
588524f48b47f32b1d412a43a3f376bcfd717db8d8a74c85bf4823c1af51ccbffbd76579544620587c84e2fea1e7ede4e2d361fb348758d8572ee7345eccfc07
-
SSDEEP
6144:/Ya66WOW6k4nLUfQzcGg6Zwaidc8J1CQC:/YgWOE4EQIhairI
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-