Behavioral task
behavioral1
Sample
377ee7bad1a3a62f5063de3d8fe7f9664b157b2599f3e1ce868010095b6da596.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
377ee7bad1a3a62f5063de3d8fe7f9664b157b2599f3e1ce868010095b6da596.exe
Resource
win10v2004-20241007-en
General
-
Target
377ee7bad1a3a62f5063de3d8fe7f9664b157b2599f3e1ce868010095b6da596.exe
-
Size
8.2MB
-
MD5
ad3dd9c2c6423605528cc7d5bb3446f0
-
SHA1
0ff822e6a9af16f2f61cc24bb53b9a51808f68ca
-
SHA256
377ee7bad1a3a62f5063de3d8fe7f9664b157b2599f3e1ce868010095b6da596
-
SHA512
12fd4cbc0285310ad0aacbf662dea489ef8a867011beed5171a16a66dbe3633f0af625e990802d7230c75985d0f70d2423e11b956d3d519a549c36331dd630cf
-
SSDEEP
49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNect:V8e8e8f8e8e8O
Malware Config
Signatures
-
Warzone RAT payload 1 IoCs
resource yara_rule sample warzonerat -
Warzonerat family
-
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 377ee7bad1a3a62f5063de3d8fe7f9664b157b2599f3e1ce868010095b6da596.exe
Files
-
377ee7bad1a3a62f5063de3d8fe7f9664b157b2599f3e1ce868010095b6da596.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.eeunG Size: 231KB - Virtual size: 568KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vnrF8 Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NNknhF Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.j5z Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lcg Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fEIePA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.3ePm Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Z4is Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Iwx Size: 25KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UWY Size: 175KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Me Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE