General

  • Target

    eae4ebd7_extracted

  • Size

    100KB

  • Sample

    210528-3dk6pshrrx

  • MD5

    8ab27c0179551ff1815a191c4211977d

  • SHA1

    46dc28cb0913ea4ec73b56a0d0bdebe06fdac9ce

  • SHA256

    e5dfed32fdfeb0f1562adbbc692458fdfb50fe98f22cc1f8521046eaf1e1a7a7

  • SHA512

    96fe4f982202e67b5a87ef4dc0df29f504f38748a1444aa3ec70b2304ea9057cfb490e169e9daaa053b5a2f32b464cd78661daf195e14615d8e742656e0335f3

Malware Config

Extracted

Family

warzonerat

C2

masterprof.warzonedns.com:5200

Targets

    • Target

      eae4ebd7_extracted

    • Size

      100KB

    • MD5

      8ab27c0179551ff1815a191c4211977d

    • SHA1

      46dc28cb0913ea4ec73b56a0d0bdebe06fdac9ce

    • SHA256

      e5dfed32fdfeb0f1562adbbc692458fdfb50fe98f22cc1f8521046eaf1e1a7a7

    • SHA512

      96fe4f982202e67b5a87ef4dc0df29f504f38748a1444aa3ec70b2304ea9057cfb490e169e9daaa053b5a2f32b464cd78661daf195e14615d8e742656e0335f3

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks