warzonerat | NEAS[.]476810890x00000000004000000x000000000055E000memorydmp_JC[.]exe | Triage

Sharing

General

Target

NEAS.476810890x00000000004000000x000000000055E000memorydmp_JC.exe
Size

1.4MB
MD5

6e95fc79a36666a49f794e9eb6c5ded9
SHA1

7b95e90d407f2fd733c24927d89673ebf59c2eb8
SHA256

4e82eb2fbdd31de3ba85b5991a038b89c2fa7ac4498a3d313fc4c1d8147eb989
SHA512

48ab72c033605f72b1a9fea6d61f957ff2d87ddbe9a51c05a0c3561b337cad20178b43762e91ebe8fbcd1eb0e9cc513756dcf1ecb7d7d56758940c98f08c1238
SSDEEP

3072:4NLOpnhTdOw9YAJOzIYigVl01T2ENipdDX0z5:4NLYdT97JSI0l0QENq4

Score

10^/10

rat warzonerat

Malware Config

Signatures

Warzone RAT payload 1 IoCs

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.476810890x00000000004000000x000000000055E000memorydmp_JC.exe

Files

NEAS.476810890x00000000004000000x000000000055E000memorydmp_JC.exe
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bss
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ