Overview

overview

10

Static

static

1

PDF.exe

windows7_x64

10

PDF.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PDF.iso

  • Size

    202KB

  • Sample

    210630-x1j748z73s

  • MD5

    fed1a8dba180e755f25469cd93409d82

  • SHA1

    1c46f75d1d2eaa2bdec6334d0599317a54dfba26

  • SHA256

    3726100479cb0016004fff0e24c15688a54d2aadbe0759e921ec23df94c1ace6

  • SHA512

    bccac7d73fd8be2c37392fb57e38a4bec46f5aa294457e1297e6d996a40d1fda7fb1cb9b207f94c6ddc4e19272cbf66e3e6f28ca7c4042b17c198bd569376889

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

185.157.160.215:2211

Targets

    • Target

      PDF.exe

    • Size

      141KB

    • MD5

      cdcdbe253da2dfdf3792f26681bbd14e

    • SHA1

      bd1a0365d57366f2e1e50834c03e885784a23dd9

    • SHA256

      c512bba369f7480f1682546ba31ac48e290887f1209a8dbbfdd1ed3de2544095

    • SHA512

      c509d15405892d24b832c2e2984587d7cd73f96e14c346be7282da8f881cae1d8e0ef3250eabc97f71247c529ce1cacae5fd064860edd6fc74a78a7746015650

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks