General

  • Target

    New order_doc.exe

  • Size

    959KB

  • Sample

    210608-449astn7le

  • MD5

    4f725e7f05311c224ef49498892ba553

  • SHA1

    49e95d8a392adff32361c96dce3db138ec7764f9

  • SHA256

    76dd27ef96d337d45cfbc7585846d998f6b0f0a3c89255a9329862877432e098

  • SHA512

    c7654e8392209773d534a20d73e0c148511ea164c82d1dc63e752bf4e02883a0b137d5d73e465a9164cfb4f13ee50579907cb45cbc6cb16c47dd2a390bd265df

Malware Config

Extracted

Family

warzonerat

C2

hongphilxxx.duckdns.org:65535

Targets

    • Target

      New order_doc.exe

    • Size

      959KB

    • MD5

      4f725e7f05311c224ef49498892ba553

    • SHA1

      49e95d8a392adff32361c96dce3db138ec7764f9

    • SHA256

      76dd27ef96d337d45cfbc7585846d998f6b0f0a3c89255a9329862877432e098

    • SHA512

      c7654e8392209773d534a20d73e0c148511ea164c82d1dc63e752bf4e02883a0b137d5d73e465a9164cfb4f13ee50579907cb45cbc6cb16c47dd2a390bd265df

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT Payload

MITRE ATT&CK Matrix

Tasks