Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

4c2905b3d2...90.exe

windows7-x64

7

4c2905b3d2...90.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c2905b3d266f6c71fa5403b24bc7290

  • Size

    13.0MB

  • Sample

    240108-w7pl5afcak

  • MD5

    4c2905b3d266f6c71fa5403b24bc7290

  • SHA1

    09afef726da63159cbb227fae2628356e4aa48c3

  • SHA256

    5271793938b84d49943f4a1af6682243a82ae3fddf2d2711268d23153554df1a

  • SHA512

    d6375887139e00810015825c416b0cac3bb8d78ee704622dfb05ea572b509c68558c09dc75e7ad7e8720616b22fcef0871bac657bbf097b6a3a1baa545fe3f3c

  • SSDEEP

    196608:yU7d9xZSt4U7d9xZStSU7d9xZSt4U7d9xZStI:D7d9xZo7d9xZS7d9xZo7d9xZX

Score
10/10
warzoneratinfostealerpersistenceratupx

Malware Config

Targets

    • Target

      4c2905b3d266f6c71fa5403b24bc7290

    • Size

      13.0MB

    • MD5

      4c2905b3d266f6c71fa5403b24bc7290

    • SHA1

      09afef726da63159cbb227fae2628356e4aa48c3

    • SHA256

      5271793938b84d49943f4a1af6682243a82ae3fddf2d2711268d23153554df1a

    • SHA512

      d6375887139e00810015825c416b0cac3bb8d78ee704622dfb05ea572b509c68558c09dc75e7ad7e8720616b22fcef0871bac657bbf097b6a3a1baa545fe3f3c

    • SSDEEP

      196608:yU7d9xZSt4U7d9xZStSU7d9xZSt4U7d9xZStI:D7d9xZo7d9xZS7d9xZo7d9xZX

    Score
    10/10
    persistenceupxwarzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Drops startup file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks