Overview

overview

10

Static

static

1

RFQ_ARN_.EXE

windows7_x64

10

RFQ_ARN_.EXE

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ ARN-PO-2021-13-00072.IMG

  • Size

    1.2MB

  • Sample

    210629-pbba37akge

  • MD5

    cc38f8e7232a99b6944fc27b1646cc02

  • SHA1

    d52113b61eced7c3cea5d8fa1c1a64986dfac3b0

  • SHA256

    0bc92d971961771b8978c8ab8d0ba39580a508b5187ea1ee2be32025fcd8c736

  • SHA512

    de3229135f90a0dcee8b10fd5531736db4139203cc185582a140a3abc10c42cedb91d22494fc2ff0dda731dffbdc9b23ce371ba821a32a4b917d8131ed813ae2

Score
10/10
warzoneratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      RFQ_ARN_.EXE

    • Size

      484KB

    • MD5

      67e02a46351f8e0bfa3d4ee467719f33

    • SHA1

      87b4d8c11bf8cd310ba57cf58a6081bcbdf15a2e

    • SHA256

      ecaaf9df12406f873f3f27894dcd77624fc37dc323b57730d483c6b84c4b685f

    • SHA512

      2545fc7776dc03c8a9555bdeb2b2fac2117863c0b594489695280246e89e6f36e3ed32741d4e1d6d4ae103518c60b072e6944558cefdf198aa5c5e4a0db1ce89

    Score
    10/10
    warzoneratinfostealerratspywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks