Overview

overview

10

Static

static

iv.exe

windows7_x64

10

iv.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    iv.exe

  • Size

    1.5MB

  • Sample

    210112-9wl9n4x2ge

  • MD5

    0adb632989ec9dcdcde9f532288cbe3d

  • SHA1

    acdac4bd2b7f53f1a598e8847f2a61be68664d2d

  • SHA256

    e5afa3d0aadbf3c559d41ae3b354e4258230de01d6514de7fd3133c1f3b6306c

  • SHA512

    a309898d7df1f037d11c2937b9fe498d0c9a9cecbf3150b36ac2f1ac8ac98d3c71253762b38a7d8ecd0843a55f3672df277e7323b08a18fd1d84a8dec1ee43a1

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

95.217.251.120:5200

Targets

    • Target

      iv.exe

    • Size

      1.5MB

    • MD5

      0adb632989ec9dcdcde9f532288cbe3d

    • SHA1

      acdac4bd2b7f53f1a598e8847f2a61be68664d2d

    • SHA256

      e5afa3d0aadbf3c559d41ae3b354e4258230de01d6514de7fd3133c1f3b6306c

    • SHA512

      a309898d7df1f037d11c2937b9fe498d0c9a9cecbf3150b36ac2f1ac8ac98d3c71253762b38a7d8ecd0843a55f3672df277e7323b08a18fd1d84a8dec1ee43a1

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks