Overview

overview

10

Static

static

10

4084-50-0x...ry.exe

windows7-x64

1

4084-50-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    4084-50-0x0000000000400000-0x0000000001400000-memory.dmp

  • Size

    16.0MB

  • MD5

    ea94a72523a42228ed90912cbebc08dc

  • SHA1

    978ab5411377ce3876f71e941ebdd6cd2bb7472d

  • SHA256

    14106613aaa0f9555b290951fea5df02ea3838a7e0e02b0e3f9a5d333958c678

  • SHA512

    b7b75cf0bae3d350178db3ab556ef9142b31cf1f5e4dbe9d2b0d5c53dfb1dc0f0dae63396abca3c41fa6813e797a9b53390fce5f2af9493ece47dd2a21b28661

  • SSDEEP

    24576:KwRSESaehwecc0ribVTWoYpgpaTl+BBVP3QVZ:nc8m1TW9

Score
10/10
ratmodiloaderwarzonerat

Malware Config

Extracted

Family

warzonerat

C2

freshwarsmi.ddns.net:5200

Signatures

  • ModiLoader Second Stage 1 IoCs
  • Modiloader family
    modiloader
  • Warzone RAT payload 1 IoCs
    rat
  • Warzonerat family
    warzonerat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4084-50-0x0000000000400000-0x0000000001400000-memory.dmp
    .exe windows:6 windows x86


    Headers

    Sections