General
-
Target
ab1ea7cc80036ae37d615bd098ec909c81797e7688182175417c01f6cc03d8baN
-
Size
1.4MB
-
Sample
241017-x2a28a1flc
-
MD5
52c5ab59fcaffd1cff43e71178412770
-
SHA1
2e750c039a1af980bb37e807a684269ab69e2f3b
-
SHA256
ab1ea7cc80036ae37d615bd098ec909c81797e7688182175417c01f6cc03d8ba
-
SHA512
8c4a70b361304c9f3f0d0affb6de0727a53ce8dce73087c79a493b1bae09acd20d187b0d499953368ff79001409bd8ff8d86dbf3d304d75dcea221cf4d46481f
-
SSDEEP
24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYl:Fo0c++OCokGs9Fa+rd1f26RNYl
Behavioral task
behavioral1
Sample
ab1ea7cc80036ae37d615bd098ec909c81797e7688182175417c01f6cc03d8baN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ab1ea7cc80036ae37d615bd098ec909c81797e7688182175417c01f6cc03d8baN.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Targets
-
-
Target
ab1ea7cc80036ae37d615bd098ec909c81797e7688182175417c01f6cc03d8baN
-
Size
1.4MB
-
MD5
52c5ab59fcaffd1cff43e71178412770
-
SHA1
2e750c039a1af980bb37e807a684269ab69e2f3b
-
SHA256
ab1ea7cc80036ae37d615bd098ec909c81797e7688182175417c01f6cc03d8ba
-
SHA512
8c4a70b361304c9f3f0d0affb6de0727a53ce8dce73087c79a493b1bae09acd20d187b0d499953368ff79001409bd8ff8d86dbf3d304d75dcea221cf4d46481f
-
SSDEEP
24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYl:Fo0c++OCokGs9Fa+rd1f26RNYl
-
NetWire RAT payload
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-