General
-
Target
a5b3a047794886e03b6dbd90a689733e
-
Size
579KB
-
Sample
240226-hmc6psfh5t
-
MD5
a5b3a047794886e03b6dbd90a689733e
-
SHA1
0ff58bdf40fa6852d2fc5e3d06dcbf5a6a43d8cf
-
SHA256
eac2062829caef9c99ee196af392009abf34b884ff9c2f909d4e9444cae5e3ae
-
SHA512
530f5566bc627c0d366647a72d5c6c9b50132ef944edaa792f282af80db6d49de52e43a1a4a8ae46f988d195280fb8dc2d5df4c5cdc7da19af78c4cafacac082
-
SSDEEP
12288:XUOycCPEyAgcmFcvkrI9rzEs0sxD+ibZD74Djhe4/DIEVuHJub7U2RBVc:EOycpyAJTkEPEs0pibZ3ogeDI7Hkb7B+
Behavioral task
behavioral1
Sample
a5b3a047794886e03b6dbd90a689733e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a5b3a047794886e03b6dbd90a689733e.exe
Resource
win10v2004-20240221-en
Malware Config
Extracted
warzonerat
185.19.85.155:1997
Targets
-
-
Target
a5b3a047794886e03b6dbd90a689733e
-
Size
579KB
-
MD5
a5b3a047794886e03b6dbd90a689733e
-
SHA1
0ff58bdf40fa6852d2fc5e3d06dcbf5a6a43d8cf
-
SHA256
eac2062829caef9c99ee196af392009abf34b884ff9c2f909d4e9444cae5e3ae
-
SHA512
530f5566bc627c0d366647a72d5c6c9b50132ef944edaa792f282af80db6d49de52e43a1a4a8ae46f988d195280fb8dc2d5df4c5cdc7da19af78c4cafacac082
-
SSDEEP
12288:XUOycCPEyAgcmFcvkrI9rzEs0sxD+ibZD74Djhe4/DIEVuHJub7U2RBVc:EOycpyAJTkEPEs0pibZ3ogeDI7Hkb7B+
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-