General

  • Target

    400000.aspnet_compiler.exe

  • Size

    98KB

  • Sample

    210607-q1662gecpx

  • MD5

    fe0b7f8d2278f25ec695c44b8238219c

  • SHA1

    2d74c907982b99b7f16fefce6bb811ac3a316299

  • SHA256

    47e4be1d34037d747ecca53a3898297bd9d15ae4e8cc5dd505eaa72036470af6

  • SHA512

    5592b6f8f78244b70ab6b62b96a96b7aa1ba68fca1bc6431379e20de46990a7055200e70fb14ac5ee00f4510f01883f0d25c3bc61cab7e0155a32fecc27e1b79

Malware Config

Extracted

Family

warzonerat

C2

5.206.224.194:3080

Targets

    • Target

      400000.aspnet_compiler.exe

    • Size

      98KB

    • MD5

      fe0b7f8d2278f25ec695c44b8238219c

    • SHA1

      2d74c907982b99b7f16fefce6bb811ac3a316299

    • SHA256

      47e4be1d34037d747ecca53a3898297bd9d15ae4e8cc5dd505eaa72036470af6

    • SHA512

      5592b6f8f78244b70ab6b62b96a96b7aa1ba68fca1bc6431379e20de46990a7055200e70fb14ac5ee00f4510f01883f0d25c3bc61cab7e0155a32fecc27e1b79

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

MITRE ATT&CK Matrix

Tasks