Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Purchase R...DF.scr

windows7-x64

10

Purchase R...DF.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14984b80f3053061841440ce496e334cbb701c09c23d051626d7691f2ba53e11

  • Size

    841KB

  • Sample

    230922-mxawjshe23

  • MD5

    78e00e1efdf897cf970d7bb28d3ffc80

  • SHA1

    e9c603a4d7c92c98c6f19c3d056cbd7a5718bc17

  • SHA256

    14984b80f3053061841440ce496e334cbb701c09c23d051626d7691f2ba53e11

  • SHA512

    d92b9580345868e9e283394f0020930a67ccab05e08983aacf662b92a1a42b299a10403bf58e809b650bdfe7758ba83827b0dfe663b58dd46f5a0d7f6beff495

  • SSDEEP

    24576:vYLYQHxjjrNKjnGgU/fxR10S9jIpq7MN47yJPdDdeqjsZgLxj3:vYLTHBjpKrLU/T10kjZS+yJJdrsZ8j3

Score
10/10
warzoneratcollectioninfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

62.102.148.158:62641

Targets

    • Target

      Purchase Request LIST_T7FIBA00541·PDF.scr

    • Size

      2.1MB

    • MD5

      9c7d52d3efd99e45827c1c5f2a070c83

    • SHA1

      3f1e80b51b4fab965c05303de521f0a47ce1d05b

    • SHA256

      2f06ccf1497fddb1e349f0a3b35126cf2af0ffb5753558cae54cb3cc1368bc0f

    • SHA512

      0927655f7c77ec4ce0a5af19a2c1671d95cdedcd334ce1866bb7fa5fe4436595872e6bafcce1fee0e0ca637608e16c1b716098e277afd340df269a9047e9ded1

    • SSDEEP

      24576:02C9SSM7qdOjn8jZmYr0ARtLKEsha4VljI4+zQ4QFBpZ4E7BaUaz+QkDKASK:y9MOsPI4+zQ4Qu4QkuAP

    Score
    10/10
    warzoneratcollectioninfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks