Overview

overview

10

Static

static

90aced49ee...3d.exe

windows7_x64

10

90aced49ee...3d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    90aced49ee9c5ce3fc9f47ba8fd7333d.exe

  • Size

    1.5MB

  • Sample

    210412-7529p6tq4j

  • MD5

    90aced49ee9c5ce3fc9f47ba8fd7333d

  • SHA1

    80aff2fec277427a40de384be7c8119a19354166

  • SHA256

    40d4ee1e0fa412176d826027c500bfbc29ee4c65bfd13dcec2f0facd0021399c

  • SHA512

    20e1d46f938eb1bf90178769074e1d6a247683d77a52776b047a4f02ad90a298dd93f641a25e9affcf08bb1a767025f70e6a628d6fa24154282abdb30b8cdecc

Score
10/10
warzoneratinfostealerpersistenceratspywarestealer

Malware Config

Extracted

Family

warzonerat

C2

101.99.91.200:5200

Targets

    • Target

      90aced49ee9c5ce3fc9f47ba8fd7333d.exe

    • Size

      1.5MB

    • MD5

      90aced49ee9c5ce3fc9f47ba8fd7333d

    • SHA1

      80aff2fec277427a40de384be7c8119a19354166

    • SHA256

      40d4ee1e0fa412176d826027c500bfbc29ee4c65bfd13dcec2f0facd0021399c

    • SHA512

      20e1d46f938eb1bf90178769074e1d6a247683d77a52776b047a4f02ad90a298dd93f641a25e9affcf08bb1a767025f70e6a628d6fa24154282abdb30b8cdecc

    Score
    10/10
    warzoneratinfostealerpersistenceratspywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Sets DLL path for service in the registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks