General

  • Target

    warzone.dll

  • Size

    113KB

  • Sample

    210610-5x1n7rtlxn

  • MD5

    4317b04ad1f8f288ab15c7266240e3fa

  • SHA1

    90a49a9bc3cb3adeb354f0d2c21996cd0edb36a6

  • SHA256

    e14bd7e2457ab8a930533b2748d9f3623b67f0bae6c0c5f7181fd48446d679aa

  • SHA512

    99e2da8cf3a536669fefbc59d5fbffc5e941693827b34ef62edc533d14cb4e78130541d35d97289b6a9db71aab7b45db71af8398f3efc1c2b9baaece65344de2

Malware Config

Extracted

Family

warzonerat

C2

79.134.225.94:5352

Targets

    • Target

      warzone.dll

    • Size

      113KB

    • MD5

      4317b04ad1f8f288ab15c7266240e3fa

    • SHA1

      90a49a9bc3cb3adeb354f0d2c21996cd0edb36a6

    • SHA256

      e14bd7e2457ab8a930533b2748d9f3623b67f0bae6c0c5f7181fd48446d679aa

    • SHA512

      99e2da8cf3a536669fefbc59d5fbffc5e941693827b34ef62edc533d14cb4e78130541d35d97289b6a9db71aab7b45db71af8398f3efc1c2b9baaece65344de2

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks