General
-
Target
a6c7f1f1e73b612bf2c34e4b6193dd41f75ec0298c694e3600756a79da348152.exe
-
Size
132KB
-
Sample
240516-b15dsaed91
-
MD5
b3390afd5206f8b49b32382041b80c2b
-
SHA1
55b2276a3aeed631535b394b048ad31a54de19d1
-
SHA256
a6c7f1f1e73b612bf2c34e4b6193dd41f75ec0298c694e3600756a79da348152
-
SHA512
ce24633a66deb47fd186b9ec2fe807635e377c772e051ddbbbad14219fcdf506a72e7366f3f1ac644f8bfd97bb3bc490f7462403e94e7eaf84ab2893e9d7a6df
-
SSDEEP
3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a
Behavioral task
behavioral1
Sample
a6c7f1f1e73b612bf2c34e4b6193dd41f75ec0298c694e3600756a79da348152.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a6c7f1f1e73b612bf2c34e4b6193dd41f75ec0298c694e3600756a79da348152.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
warzonerat
45.138.16.138:5200
Targets
-
-
Target
a6c7f1f1e73b612bf2c34e4b6193dd41f75ec0298c694e3600756a79da348152.exe
-
Size
132KB
-
MD5
b3390afd5206f8b49b32382041b80c2b
-
SHA1
55b2276a3aeed631535b394b048ad31a54de19d1
-
SHA256
a6c7f1f1e73b612bf2c34e4b6193dd41f75ec0298c694e3600756a79da348152
-
SHA512
ce24633a66deb47fd186b9ec2fe807635e377c772e051ddbbbad14219fcdf506a72e7366f3f1ac644f8bfd97bb3bc490f7462403e94e7eaf84ab2893e9d7a6df
-
SSDEEP
3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables embedding command execution via IExecuteCommand COM object
-
Warzone RAT payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-