General

  • Target

    b6bd7e3441e81b784e91079392abd5ec.exe

  • Size

    680KB

  • Sample

    210627-2cwrw49n4n

  • MD5

    b6bd7e3441e81b784e91079392abd5ec

  • SHA1

    18845b925092aade6be7013cd169e110c1ec80fc

  • SHA256

    555a20d3756ad65f74f4ea768098c703a14bdb667772223abb8ea6e1c084ee7c

  • SHA512

    64a3df2fbc5d3da2e1e0e3b26921dd603e17f8de6e39bfb9648166af9b19d400c382a89a3ba74d9ffd0566025f0aba6c16a0732535168fc24e78762835270a6a

Malware Config

Extracted

Family

warzonerat

C2

seencroundercontroller.webredirect.org:1894

Targets

    • Target

      b6bd7e3441e81b784e91079392abd5ec.exe

    • Size

      680KB

    • MD5

      b6bd7e3441e81b784e91079392abd5ec

    • SHA1

      18845b925092aade6be7013cd169e110c1ec80fc

    • SHA256

      555a20d3756ad65f74f4ea768098c703a14bdb667772223abb8ea6e1c084ee7c

    • SHA512

      64a3df2fbc5d3da2e1e0e3b26921dd603e17f8de6e39bfb9648166af9b19d400c382a89a3ba74d9ffd0566025f0aba6c16a0732535168fc24e78762835270a6a

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks