General
-
Target
d02e7036dcce34d85849df93ec36c62f
-
Size
236KB
-
Sample
240317-hdmnsagg71
-
MD5
d02e7036dcce34d85849df93ec36c62f
-
SHA1
211c57f2f2e2f3cf11ce59f6848d8c7cce41fd18
-
SHA256
c9f708d196905d6b42dda2b45f3a3965517d5cdc885f7b3b8824aaed33da5fff
-
SHA512
8807912b873d950e37504a845e0c198e468fd4eb454d97ed877ed648ac8bb80c9c41b0bc3ae95100ecc210c2473cdd1d07d86a75acfce440e79c7c95c48ba12f
-
SSDEEP
3072:ASWUYAlmXkJr4Dul8kZyLA93qlUD2mvwV6bFcHSRoodGv8Z36CxVYwwBJ785v7Wt:AEsBi17NCFYp3rtHmqbK65o
Static task
static1
Behavioral task
behavioral1
Sample
d02e7036dcce34d85849df93ec36c62f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d02e7036dcce34d85849df93ec36c62f.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
warzonerat
185.140.53.41:2104
Targets
-
-
Target
d02e7036dcce34d85849df93ec36c62f
-
Size
236KB
-
MD5
d02e7036dcce34d85849df93ec36c62f
-
SHA1
211c57f2f2e2f3cf11ce59f6848d8c7cce41fd18
-
SHA256
c9f708d196905d6b42dda2b45f3a3965517d5cdc885f7b3b8824aaed33da5fff
-
SHA512
8807912b873d950e37504a845e0c198e468fd4eb454d97ed877ed648ac8bb80c9c41b0bc3ae95100ecc210c2473cdd1d07d86a75acfce440e79c7c95c48ba12f
-
SSDEEP
3072:ASWUYAlmXkJr4Dul8kZyLA93qlUD2mvwV6bFcHSRoodGv8Z36CxVYwwBJ785v7Wt:AEsBi17NCFYp3rtHmqbK65o
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Suspicious use of SetThreadContext
-