Overview

overview

10

Static

static

New order_doc.exe

windows7_x64

10

New order_doc.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New order_doc.lzh

  • Size

    418KB

  • Sample

    210608-n2hq7n1tax

  • MD5

    326786cdfd57dd4d018ff1c9f2c70802

  • SHA1

    810bfbfbb1bf2487ae4f5945de77ef5957243d2d

  • SHA256

    5c8ba98576d72f725ac03c6a79f3fbb39cd7ba65c54402e80af1d2d1f12c4d2a

  • SHA512

    23525779ca8bcf2e63a7e1deb464047e1df4bea1b5ab7f097c23e93e29f6fc088aa20e488d593af1b522fe9cf2213710ce0992dd69b022125572713ad2d13871

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

hongphilxxx.duckdns.org:65535

Targets

    • Target

      New order_doc.exe

    • Size

      959KB

    • MD5

      4f725e7f05311c224ef49498892ba553

    • SHA1

      49e95d8a392adff32361c96dce3db138ec7764f9

    • SHA256

      76dd27ef96d337d45cfbc7585846d998f6b0f0a3c89255a9329862877432e098

    • SHA512

      c7654e8392209773d534a20d73e0c148511ea164c82d1dc63e752bf4e02883a0b137d5d73e465a9164cfb4f13ee50579907cb45cbc6cb16c47dd2a390bd265df

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks