Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bab.exe

  • Size

    113KB

  • Sample

    240128-p9qhwabcc6

  • MD5

    8d80bcf8e28f59faa0d7571546e258b6

  • SHA1

    032efd6c3247d963b9292c0dfe9ccd47fe6f9a9f

  • SHA256

    7d5ce8feaaac8488197a12aa640d7b6f32f109dda578293a8b86f8a712f4ee0b

  • SHA512

    d26fb98aee6e0b273dfe9c19afd11d15e4b9b0dced141f705755132d8d15a5d5b11869aa5b8131509eb34f933d682867040cf36f6b5026e1ce4bf32a1f10e598

  • SSDEEP

    1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0

Malware Config

Extracted

Family

warzonerat

C2

bossnew.ddns.net:1001

Targets

    • Target

      bab.exe

    • Size

      113KB

    • MD5

      8d80bcf8e28f59faa0d7571546e258b6

    • SHA1

      032efd6c3247d963b9292c0dfe9ccd47fe6f9a9f

    • SHA256

      7d5ce8feaaac8488197a12aa640d7b6f32f109dda578293a8b86f8a712f4ee0b

    • SHA512

      d26fb98aee6e0b273dfe9c19afd11d15e4b9b0dced141f705755132d8d15a5d5b11869aa5b8131509eb34f933d682867040cf36f6b5026e1ce4bf32a1f10e598

    • SSDEEP

      1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks