Overview

overview

10

Static

static

b214cee84b...9a.exe

windows7_x64

10

b214cee84b...9a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b214cee84b16aeb61636a83879b2fc9a

  • Size

    412KB

  • Sample

    210709-asfsmfp4ye

  • MD5

    b214cee84b16aeb61636a83879b2fc9a

  • SHA1

    b496aef57c8b1712c7e16abb098c20d544e2c639

  • SHA256

    808471efa1f93a3e6a70c762b8e6d980258c40bb3a6f6aacb08486e64e1ae18f

  • SHA512

    cb3999ed5bfc7164770fbf34d947154a124dedaef59f95d543b0a3ec6d3f9063bbacb94650564f78158e05b3b0cee5e99770970c909a3f29ab924ccd46c1fe67

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

147.124.213.132:5200

Targets

    • Target

      b214cee84b16aeb61636a83879b2fc9a

    • Size

      412KB

    • MD5

      b214cee84b16aeb61636a83879b2fc9a

    • SHA1

      b496aef57c8b1712c7e16abb098c20d544e2c639

    • SHA256

      808471efa1f93a3e6a70c762b8e6d980258c40bb3a6f6aacb08486e64e1ae18f

    • SHA512

      cb3999ed5bfc7164770fbf34d947154a124dedaef59f95d543b0a3ec6d3f9063bbacb94650564f78158e05b3b0cee5e99770970c909a3f29ab924ccd46c1fe67

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks