Overview

overview

10

Static

static

pdf file.exe

windows7_x64

3

pdf file.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pdf_file.iso

  • Size

    1.2MB

  • Sample

    210707-dvkqk9jfl6

  • MD5

    807721222a16167de1aecfb0b7cbd9a5

  • SHA1

    dd39e9c9b8d235e046b08dcc69b18cfa1f38f5df

  • SHA256

    1102bbe5826dcc2de429fc1e3d249a98430889a875a4bc1505fc9e520d0140d3

  • SHA512

    4d767c557f3038ea970b1ceca16cbf43438e18b8e19f3cb0e4d02677f28058357023ca290dfb82bd8ead96697385809aec591e4c80288440dddc785f378dfc21

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

185.157.160.215:2211

Targets

    • Target

      pdf file.exe

    • Size

      1.1MB

    • MD5

      3cbd781f564cf84ffef48e204f447b2d

    • SHA1

      62a79b0bde60d2b46ceb204bd127065d64c66d3d

    • SHA256

      686f4b4a55d410762e893e7caccfe000ff0b927339a4da65b3076ac932d8b409

    • SHA512

      5ae28a6458f9368ce0a5f08b189903171372514b3aeb218a21affd4448d4c4d97e382dd6153e63e1bfbde0d675438544125153f9530f234198a783d6e6d027ac

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks