Overview

overview

10

Static

static

10

1696-47-0x...ry.exe

windows7-x64

1696-47-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1696-47-0x0000000000400000-0x0000000001400000-memory.dmp

  • Size

    16.0MB

  • MD5

    effdbb00b2635925756a5c5cd7a2dc3f

  • SHA1

    6032f242ca25f5084c9660aaa6dc75e55c852b5f

  • SHA256

    e83038b3499682cbfab6a534cd2d4453c618356172d3f95b45602fd6c349b56c

  • SHA512

    d89a2fca6b4a4c03510350f8e5af4674fd5e4a6b93029ad11927ece4f51ae0a950b81f3c51038fed9a2e6c32912333765299f1bb4ed7e5d2b8e17aa0a9addf20

  • SSDEEP

    24576:2dye9Y4MpHWibVdrkBXiczJpnTAiaTl+BBVPm:y2lHtdrkBXJJp

Score
10/10
ratmodiloaderwarzonerat

Malware Config

Extracted

Family

warzonerat

C2

freshwarsmi.ddns.net:5200

Signatures

  • ModiLoader Second Stage 1 IoCs
  • Modiloader family
    modiloader
  • Warzone RAT payload 1 IoCs
    rat
  • Warzonerat family
    warzonerat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1696-47-0x0000000000400000-0x0000000001400000-memory.dmp
    .exe windows:6 windows x86


    Headers

    Sections