Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
14984b80f3053061841440ce496e334cbb701c09c23d051626d7691f2ba53e11
-
Size
841KB
-
Sample
230922-mxawjshe23
-
MD5
78e00e1efdf897cf970d7bb28d3ffc80
-
SHA1
e9c603a4d7c92c98c6f19c3d056cbd7a5718bc17
-
SHA256
14984b80f3053061841440ce496e334cbb701c09c23d051626d7691f2ba53e11
-
SHA512
d92b9580345868e9e283394f0020930a67ccab05e08983aacf662b92a1a42b299a10403bf58e809b650bdfe7758ba83827b0dfe663b58dd46f5a0d7f6beff495
-
SSDEEP
24576:vYLYQHxjjrNKjnGgU/fxR10S9jIpq7MN47yJPdDdeqjsZgLxj3:vYLTHBjpKrLU/T10kjZS+yJJdrsZ8j3
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Request LIST_T7FIBA00541·PDF.scr
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Purchase Request LIST_T7FIBA00541·PDF.scr
Resource
win10v2004-20230915-en
Malware Config
Extracted
warzonerat
62.102.148.158:62641
Targets
-
-
Target
Purchase Request LIST_T7FIBA00541·PDF.scr
-
Size
2.1MB
-
MD5
9c7d52d3efd99e45827c1c5f2a070c83
-
SHA1
3f1e80b51b4fab965c05303de521f0a47ce1d05b
-
SHA256
2f06ccf1497fddb1e349f0a3b35126cf2af0ffb5753558cae54cb3cc1368bc0f
-
SHA512
0927655f7c77ec4ce0a5af19a2c1671d95cdedcd334ce1866bb7fa5fe4436595872e6bafcce1fee0e0ca637608e16c1b716098e277afd340df269a9047e9ded1
-
SSDEEP
24576:02C9SSM7qdOjn8jZmYr0ARtLKEsha4VljI4+zQ4QFBpZ4E7BaUaz+QkDKASK:y9MOsPI4+zQ4Qu4QkuAP
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-