Overview

overview

10

Static

static

1

RFQ_ARN_.EXE

windows7_x64

10

RFQ_ARN_.EXE

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ ARN-PO-2021-13-00074.IMG

  • Size

    1.2MB

  • Sample

    210629-kln8dz57ha

  • MD5

    bf86fbf3df977e6f74040dff8a04dc63

  • SHA1

    ff2d8c0cef7fa44585cde78871b01b97a87d338f

  • SHA256

    cb20a342cc885e75e8185f86311406092c7d5e9d4129ae96448b73304b8ea195

  • SHA512

    16ded7e4aac0b5a685db1d8b23ac3f956693701879f9147012ae8a92c83f8caa289811c1693c30650b73d8ecc9181ebc9b1f36b3d23dffbf1feb10dc58938b84

Score
10/10
warzoneratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      RFQ_ARN_.EXE

    • Size

      484KB

    • MD5

      67e02a46351f8e0bfa3d4ee467719f33

    • SHA1

      87b4d8c11bf8cd310ba57cf58a6081bcbdf15a2e

    • SHA256

      ecaaf9df12406f873f3f27894dcd77624fc37dc323b57730d483c6b84c4b685f

    • SHA512

      2545fc7776dc03c8a9555bdeb2b2fac2117863c0b594489695280246e89e6f36e3ed32741d4e1d6d4ae103518c60b072e6944558cefdf198aa5c5e4a0db1ce89

    Score
    10/10
    warzoneratinfostealerratspywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks