Overview

overview

10

Static

static

10

f8fc47b239...fa.exe

windows7_x64

10

f8fc47b239...fa.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8fc47b239020267d15dbe3341300556e49045fa.zip

  • Size

    1.7MB

  • Sample

    210607-gy5ddx1jk6

  • MD5

    8bcc29a2c8b75165b2e145cdac2754ea

  • SHA1

    a2554dcaa65d91adeabd06521602c994f8d29ee0

  • SHA256

    232fa0ccf0d7101b181f4b5d8d3ff8922add3201a9ec0775bd7a3dc92c83593d

  • SHA512

    955e094f15bf7efefbc6ee3b59613f8e65a1a55f0bd668a9b4cb858bd95226919d46ea25e1e89071ad1a835d1948f94e656eed64364c7121a0a03a9f6fbdcbf8

Score
10/10
warzoneratxmrigevasioninfostealerminerpersistencerat

Malware Config

Targets

    • Target

      f8fc47b239020267d15dbe3341300556e49045fa

    • Size

      2.9MB

    • MD5

      c5e28bfedb16297faa7457ceb5227cee

    • SHA1

      f8fc47b239020267d15dbe3341300556e49045fa

    • SHA256

      8733e10a589c028f8a2ccffc49d38b1293664e097401bee7053c4ec84f0565fa

    • SHA512

      41c5b2c253f9901ff734aa3fa184ded36e11c3652a3f0eaa87e40c509be61bf320de06c62e26f017533c64f82abbca48e6ca51576544135341da7832be4d6506

    Score
    10/10
    warzoneratxmrigevasioninfostealerminerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks