Overview

overview

10

Static

static

TT.exe

windows7_x64

10

TT.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TT.exe

  • Size

    1.5MB

  • Sample

    210112-2m57cjnpbn

  • MD5

    d074acab7ccb3a5e0991fe9274fdca20

  • SHA1

    dff5ce1faa43bfb7ba8fceeba7d044a7eba37e45

  • SHA256

    023823859e196b15112c3e59e6247ceef4001f5a36f0e1383aa63b3b5a1c3aa6

  • SHA512

    e9a2ed5c89d4230ab5d4613def6e99d41a971e8e4350e9e0e1dc0cf842ea292484f20771b8f8e2278ff5a91b4f9adc59c0585e6c463b2e3a86cabbe16313b576

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

185.222.57.213:5200

Targets

    • Target

      TT.exe

    • Size

      1.5MB

    • MD5

      d074acab7ccb3a5e0991fe9274fdca20

    • SHA1

      dff5ce1faa43bfb7ba8fceeba7d044a7eba37e45

    • SHA256

      023823859e196b15112c3e59e6247ceef4001f5a36f0e1383aa63b3b5a1c3aa6

    • SHA512

      e9a2ed5c89d4230ab5d4613def6e99d41a971e8e4350e9e0e1dc0cf842ea292484f20771b8f8e2278ff5a91b4f9adc59c0585e6c463b2e3a86cabbe16313b576

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks