Behavioral task
behavioral1
Sample
fd73487d66a8ede05e79e064e0fda1bed47fa961e5522db3238801c5a3f01fba.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
fd73487d66a8ede05e79e064e0fda1bed47fa961e5522db3238801c5a3f01fba.exe
Resource
win10v2004-20241007-en
General
-
Target
fd73487d66a8ede05e79e064e0fda1bed47fa961e5522db3238801c5a3f01fba
-
Size
2.9MB
-
MD5
8a1f8c2808b91865a87bf8f6079b9c6d
-
SHA1
08567293c999fa221ed3b3c6ea2ce0734d886c44
-
SHA256
fd73487d66a8ede05e79e064e0fda1bed47fa961e5522db3238801c5a3f01fba
-
SHA512
8c76e4c79e15041f15a59cc314c7e990362adab8d6d612c907aa49961785fc0d3b6e27c7f4b2feff4b7abfa956a491e361bcd9fd164a03a568c2526619a81416
-
SSDEEP
24576:eTy7ASmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH/:eTy7ASmw4gxeOw46fUbNecCCFbNecY
Malware Config
Signatures
-
Warzone RAT payload 1 IoCs
resource yara_rule sample warzonerat -
Warzonerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd73487d66a8ede05e79e064e0fda1bed47fa961e5522db3238801c5a3f01fba
Files
-
fd73487d66a8ede05e79e064e0fda1bed47fa961e5522db3238801c5a3f01fba.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ