General

  • Target

    10b.zip

  • Size

    639KB

  • Sample

    210524-56qdvx29ha

  • MD5

    571ebed5abb3a91ca36de366f77cc888

  • SHA1

    ec6764b5d61d2788a720ade51a72bb8f2cda9d68

  • SHA256

    9b4055863b5fddea27dac8436cb4561c182c2ae4662780615eb3079a67011bcf

  • SHA512

    a3b09efe314b073125e44744a66cadabf7268757a146ebf45b3d2a5b7d24ea74932d2ae9d28d8b69816a39dba7d791919151e3fedcbf472152c1d8eb36c9ee45

Malware Config

Extracted

Family

warzonerat

C2

157.55.136.23:5300

Targets

    • Target

      d80ef3539826be2df8fc985eada5f191b3ae9eb9eb53dfbb054651d25daafe23.bin

    • Size

      946KB

    • MD5

      9ff1b2088f56e257a002e806a181a3b8

    • SHA1

      af0ac66cf6c48c7b8429acb8053f99160eea5c8c

    • SHA256

      d80ef3539826be2df8fc985eada5f191b3ae9eb9eb53dfbb054651d25daafe23

    • SHA512

      fe1b9266eca9168462ac4904f5ebda1c8830340a1b1f23066f715616ed2c5fcd472efb0214c95de14b13f5f8180ddfd7edfb24a2e16fde6101c834c93c9ea75e

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks