Overview

overview

10

Static

static

10

2520-48-0x...ry.exe

windows7-x64

1

2520-48-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2520-48-0x0000000000400000-0x0000000001400000-memory.dmp

  • Size

    16.0MB

  • MD5

    5fdbc0f90d6b105ba33586f936b8968d

  • SHA1

    6be569195144000e4854bd5aecb634060cc0e591

  • SHA256

    401ab62781f5f6482ab7ee52d55d3924b408258e706a649d83fda144060043be

  • SHA512

    1b9892e992218f421d0b0d138cb287d76280f67f0b746c9ce6ba6c351a9fccf2bb1d0415b505a879e61d7efb83c513995febc763b31cf6bcb29de407811e800b

  • SSDEEP

    12288:KwqYSESael2UKUE1bN0ib62nHLvwjS1WsrmjjcAc3C+9XS/OsLZuvju8V:KwRSESael2UKU6GibVTWSBPSwhsZu

Score
10/10
ratmodiloaderwarzonerat

Malware Config

Extracted

Family

warzonerat

C2

freshwarsmi.ddns.net:5200

Signatures

  • ModiLoader Second Stage 1 IoCs
  • Modiloader family
    modiloader
  • Warzone RAT payload 1 IoCs
    rat
  • Warzonerat family
    warzonerat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2520-48-0x0000000000400000-0x0000000001400000-memory.dmp
    .exe windows:6 windows x86


    Headers

    Sections