Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    775385bc6c4d8a59c167514aeb97c80856da11429b0c37db22c808908c4de73e

  • Size

    233KB

  • Sample

    231107-rpxgsshb41

  • MD5

    e1f0900fd5e06781b90672ac17d93183

  • SHA1

    d661223516d41c3594be6a4bcea6bcb52e5b227b

  • SHA256

    775385bc6c4d8a59c167514aeb97c80856da11429b0c37db22c808908c4de73e

  • SHA512

    52cab432d51d42c1a5932366f481f651bd33512da924b3f375723260243739a52fea581b21cb730850af3567dabe66de520b73efb197b766e810c10682422f30

  • SSDEEP

    6144:G0G/OX0qr9tnMZD37F0xiwBP/DGDMDSj:4/6XxoqxTPrGS

Malware Config

Extracted

Family

warzonerat

C2

185.225.75.68:2222

Targets

    • Target

      775385bc6c4d8a59c167514aeb97c80856da11429b0c37db22c808908c4de73e

    • Size

      233KB

    • MD5

      e1f0900fd5e06781b90672ac17d93183

    • SHA1

      d661223516d41c3594be6a4bcea6bcb52e5b227b

    • SHA256

      775385bc6c4d8a59c167514aeb97c80856da11429b0c37db22c808908c4de73e

    • SHA512

      52cab432d51d42c1a5932366f481f651bd33512da924b3f375723260243739a52fea581b21cb730850af3567dabe66de520b73efb197b766e810c10682422f30

    • SSDEEP

      6144:G0G/OX0qr9tnMZD37F0xiwBP/DGDMDSj:4/6XxoqxTPrGS

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks