warzonerat | 8d9da1d788ebe7f59e20c10e6283757e407a2e3befc63b4df9df138d3277b39c

General

Target
0110199383737338466578282847.scr
Size 201KB
Sample210210-5165kbaefs
SHA256 8d9da1d788ebe7f59e20c10e6283757e407a2e3befc63b4df9df138d3277b39c
MD5 67c1edd5ba59823b2817a48a8cc5a9e1
SHA1 e7b2c1022dbc3df1142052019d2eca990e4a0cee
SHA512 8b8a4ca731a1ac07a8598484e28c219a4679d574db4b745f0bd7f36eee05d61d4569183af97c992d8de28bd58a5d3dfb359a5e9e1e97c30f746383e1f48cf3ed
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

xchilogs.duckdns.org:23489

Targets

- Target
  0110199383737338466578282847.scr
- Size 201KB
- SHA256 8d9da1d788ebe7f59e20c10e6283757e407a2e3befc63b4df9df138d3277b39c
- MD5 67c1edd5ba59823b2817a48a8cc5a9e1
- SHA1 e7b2c1022dbc3df1142052019d2eca990e4a0cee
- SHA512 8b8a4ca731a1ac07a8598484e28c219a4679d574db4b745f0bd7f36eee05d61d4569183af97c992d8de28bd58a5d3dfb359a5e9e1e97c30f746383e1f48cf3ed
- MD5 SHA1 SHA512
Score

10^/10

warzonerat infostealer persistence rat
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT Payload
  rat
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

WarzoneRat, AveMaria

Warzone RAT Payload

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2