Overview

overview

10

Static

static

3f5c8c35ce...0b.exe

windows7_x64

10

3f5c8c35ce...0b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3f5c8c35ce923eec70e2e2638bef39ff55866ccf5ceaed62999e5376d598f30b

  • Size

    375KB

  • Sample

    210114-fm8etaap9s

  • MD5

    dbfa10be9e078d321c708bcd38bbebf0

  • SHA1

    66e50bbf28ce0f776acb439bb218a115e3451738

  • SHA256

    3f5c8c35ce923eec70e2e2638bef39ff55866ccf5ceaed62999e5376d598f30b

  • SHA512

    d9d2df5b3e8ba720f0202447c7ae505db5c65ca702565512cc15b618846d86674b13eb7166881917a9dbaa01cd18b0fd117a47f09ce25474ce2a9f14d26d3144

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Targets

    • Target

      3f5c8c35ce923eec70e2e2638bef39ff55866ccf5ceaed62999e5376d598f30b

    • Size

      375KB

    • MD5

      dbfa10be9e078d321c708bcd38bbebf0

    • SHA1

      66e50bbf28ce0f776acb439bb218a115e3451738

    • SHA256

      3f5c8c35ce923eec70e2e2638bef39ff55866ccf5ceaed62999e5376d598f30b

    • SHA512

      d9d2df5b3e8ba720f0202447c7ae505db5c65ca702565512cc15b618846d86674b13eb7166881917a9dbaa01cd18b0fd117a47f09ce25474ce2a9f14d26d3144

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks