Overview

overview

10

Static

static

SF40_DOC.EXE

windows7_x64

10

SF40_DOC.EXE

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06a3fe74ff3dd352db742ac96c6fbd0da1a0d98164dda2a6637e809ec0f48b35.bin

  • Size

    1.4MB

  • Sample

    210709-abfq6g321a

  • MD5

    4f7714d1358d9451b02c68a3511c182f

  • SHA1

    b77289daf38b5bf421884f01b029e668bfc63b4c

  • SHA256

    06a3fe74ff3dd352db742ac96c6fbd0da1a0d98164dda2a6637e809ec0f48b35

  • SHA512

    35e1609f0488854aa0bd669a930dc6491447ee94d2ac0ea5432b1164982a6f320799f9570686a55601d1f3f6a8eb97483f41183e5a33f773cee4388e9470074a

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

165.22.5.66:6666

Targets

    • Target

      SF40_DOC.EXE

    • Size

      849KB

    • MD5

      5fa6432e603ca1213d01f299bbca424e

    • SHA1

      a19e5b5d4cef9deeab13cce791667b9f5d0197e8

    • SHA256

      538dd70b0fda0df8180fb4ee04301a46b70fde291f20bffdd898d686a89915f1

    • SHA512

      5aabcdc101b0cabf53181ddacd8decd06b795684b7358452afb198a638a1e6a474605eba8f8d9c9ae78a55d0df1544060608ff634ef35ebb587d1f21d41911fc

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks