warzonerat | 241127-xg52vs1rfj_pw_infected[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

241127-xg52vs1rfj_pw_infected.zip
Size

4.1MB
MD5

e28c6cfe0d6d7c9bdb878e7ba19cded2
SHA1

03d34ca37cbd9536a42cfdcbbfe6fe3c8f03c03f
SHA256

ad7c40e2ac4f78f7b3453e3211a5ba2eace89e2d660872d9be76384ed1572759
SHA512

f980230effdd38125623c8a0f2170efd7756533d8111479c2dd14c21693567d0b7bfaba315a407d931be595233395ba1bdfb8748e2b4dbf016dee9b6003c7262
SSDEEP

98304:GavbgK6lPwXJ5zHXj/EeCdvlwNmr3tSUkE3KajLSPo6sbRSOE9:GavEM/EeCdSYr9Ss3KajLSP/N

Score

10^/10

rat aspackv2 warzonerat

Malware Config

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
static1/unpack001/730f0f4852ff31031bf53ccf6e2ded40ee354b20f316c082fa94c957e9f98ceb.exe	warzonerat

Warzonerat family
warzonerat

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/730f0f4852ff31031bf53ccf6e2ded40ee354b20f316c082fa94c957e9f98ceb.exe	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/730f0f4852ff31031bf53ccf6e2ded40ee354b20f316c082fa94c957e9f98ceb.exe

Files

241127-xg52vs1rfj_pw_infected.zip
.zip

Password: infected
730f0f4852ff31031bf53ccf6e2ded40ee354b20f316c082fa94c957e9f98ceb.exe
.exe windows:4 windows x86 arch:x86

Password: infected

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.eeunG
Size: 231KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vnrF8
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.NNknhF
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.j5z
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lcg
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fEIePA
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.3ePm
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Z4is
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Iwx
Size: 25KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UWY
Size: 175KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Me
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Headers

File Characteristics

Sections

.eeunG Size: 231KB - Virtual size: 568KB

.vnrF8 Size: 1KB - Virtual size: 4KB

.NNknhF Size: 4KB - Virtual size: 12KB

.j5z Size: - Virtual size: 16KB

.lcg Size: 3KB - Virtual size: 12KB

.fEIePA Size: - Virtual size: 4KB

.3ePm Size: 512B - Virtual size: 4KB

.Z4is Size: - Virtual size: 36KB

.Iwx Size: 25KB - Virtual size: 264KB

.UWY Size: 175KB - Virtual size: 176KB

.Me Size: - Virtual size: 4KB

.eeunG
Size: 231KB - Virtual size: 568KB

.vnrF8
Size: 1KB - Virtual size: 4KB

.NNknhF
Size: 4KB - Virtual size: 12KB

.j5z
Size: - Virtual size: 16KB

.lcg
Size: 3KB - Virtual size: 12KB

.fEIePA
Size: - Virtual size: 4KB

.3ePm
Size: 512B - Virtual size: 4KB

.Z4is
Size: - Virtual size: 36KB

.Iwx
Size: 25KB - Virtual size: 264KB

.UWY
Size: 175KB - Virtual size: 176KB

.Me
Size: - Virtual size: 4KB