General
-
Target
6aa115e03c3a0a7a2e8b8122c4c484263dc004c6b1f168b98922d89d6570a6e4.exe
-
Size
603KB
-
Sample
240531-bpt4nshf4t
-
MD5
473e257ef6b1e2336ed32ffb5d2abb35
-
SHA1
df1f9ca61f8233c9b555f02dd2a8c384a8971af0
-
SHA256
6aa115e03c3a0a7a2e8b8122c4c484263dc004c6b1f168b98922d89d6570a6e4
-
SHA512
e2958033617fcdacf1eb1f4553c6cb22841c7b3bfa4c48e3da8e3d726773dc474bc154178e97d8d8aa9890852495aadbe5b0559b77b335b45a57b693a6fe9938
-
SSDEEP
12288:t2iNjJS4V1JslzoOIK/aFcXFt0rCDKobXjjPwJkI61xLkR:t1XScEa2t0reXjTJRw
Static task
static1
Behavioral task
behavioral1
Sample
6aa115e03c3a0a7a2e8b8122c4c484263dc004c6b1f168b98922d89d6570a6e4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6aa115e03c3a0a7a2e8b8122c4c484263dc004c6b1f168b98922d89d6570a6e4.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
warzonerat
185.241.208.229:51997
Targets
-
-
Target
6aa115e03c3a0a7a2e8b8122c4c484263dc004c6b1f168b98922d89d6570a6e4.exe
-
Size
603KB
-
MD5
473e257ef6b1e2336ed32ffb5d2abb35
-
SHA1
df1f9ca61f8233c9b555f02dd2a8c384a8971af0
-
SHA256
6aa115e03c3a0a7a2e8b8122c4c484263dc004c6b1f168b98922d89d6570a6e4
-
SHA512
e2958033617fcdacf1eb1f4553c6cb22841c7b3bfa4c48e3da8e3d726773dc474bc154178e97d8d8aa9890852495aadbe5b0559b77b335b45a57b693a6fe9938
-
SSDEEP
12288:t2iNjJS4V1JslzoOIK/aFcXFt0rCDKobXjjPwJkI61xLkR:t1XScEa2t0reXjTJRw
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables embedding command execution via IExecuteCommand COM object
-
Warzone RAT payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Suspicious use of SetThreadContext
-