General
-
Target
afa887c1eb5644f68522d1a298942459
-
Size
236KB
-
Sample
240229-2nx22sef3w
-
MD5
afa887c1eb5644f68522d1a298942459
-
SHA1
4d0feb5610502cb7f33a5d7e6e93922d6b26a1b2
-
SHA256
2fd08e554d205eff9cc16a27e59b94abad98311738a109b8efe3523291833c3c
-
SHA512
f746e91bc6981e6f53f95f032e901ddbad7edcbde004f189d350552d6f558310a0227535b8c086b5f0f88107a8e721aedf12c35764a9dcc41f9831fa642f4c23
-
SSDEEP
3072:PWUYAlmXkJr4Dul8kZyLA93qlUD2mvwV6bFcHSRoodGv8Z36CxVYwwBJ785v7W8g:vsBi17NCFYp3rtHmqbK65K
Static task
static1
Behavioral task
behavioral1
Sample
afa887c1eb5644f68522d1a298942459.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
afa887c1eb5644f68522d1a298942459.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
warzonerat
185.140.53.41:2104
Targets
-
-
Target
afa887c1eb5644f68522d1a298942459
-
Size
236KB
-
MD5
afa887c1eb5644f68522d1a298942459
-
SHA1
4d0feb5610502cb7f33a5d7e6e93922d6b26a1b2
-
SHA256
2fd08e554d205eff9cc16a27e59b94abad98311738a109b8efe3523291833c3c
-
SHA512
f746e91bc6981e6f53f95f032e901ddbad7edcbde004f189d350552d6f558310a0227535b8c086b5f0f88107a8e721aedf12c35764a9dcc41f9831fa642f4c23
-
SSDEEP
3072:PWUYAlmXkJr4Dul8kZyLA93qlUD2mvwV6bFcHSRoodGv8Z36CxVYwwBJ785v7W8g:vsBi17NCFYp3rtHmqbK65K
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Suspicious use of SetThreadContext
-