Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bf0baeedce73785238ace59df3906e68

  • Size

    1.8MB

  • Sample

    231222-rpmycshebk

  • MD5

    bf0baeedce73785238ace59df3906e68

  • SHA1

    a7e1a1611189c200c86ef6fcf174beafe2b783bc

  • SHA256

    ec6d01f6c374e83112445655eb88af26a9ec92ff701673c7c42ff5735777a3d2

  • SHA512

    6e711e45b33c9ebe17e0ed6afad8eaf9db530e64313c17d91dc0457fbda44de3ef8603203ddfe2cece4109d00cbd65e3233ec77c8387ca024fabf9cb4e3e854a

  • SSDEEP

    49152:vhtORUwc166NlRq7vLSUtwtkwvbF6CWroWFeZkP9aiK+d:vhtORUB166NHq7vLZcpDF6CWBFeZkP9t

Malware Config

Extracted

Family

warzonerat

C2

sept5th.ddns.net:2022

Targets

    • Target

      bf0baeedce73785238ace59df3906e68

    • Size

      1.8MB

    • MD5

      bf0baeedce73785238ace59df3906e68

    • SHA1

      a7e1a1611189c200c86ef6fcf174beafe2b783bc

    • SHA256

      ec6d01f6c374e83112445655eb88af26a9ec92ff701673c7c42ff5735777a3d2

    • SHA512

      6e711e45b33c9ebe17e0ed6afad8eaf9db530e64313c17d91dc0457fbda44de3ef8603203ddfe2cece4109d00cbd65e3233ec77c8387ca024fabf9cb4e3e854a

    • SSDEEP

      49152:vhtORUwc166NlRq7vLSUtwtkwvbF6CWroWFeZkP9aiK+d:vhtORUB166NHq7vLZcpDF6CWBFeZkP9t

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks