General

  • Target

    b214cee84b16aeb61636a83879b2fc9a

  • Size

    412KB

  • Sample

    210709-asfsmfp4ye

  • MD5

    b214cee84b16aeb61636a83879b2fc9a

  • SHA1

    b496aef57c8b1712c7e16abb098c20d544e2c639

  • SHA256

    808471efa1f93a3e6a70c762b8e6d980258c40bb3a6f6aacb08486e64e1ae18f

  • SHA512

    cb3999ed5bfc7164770fbf34d947154a124dedaef59f95d543b0a3ec6d3f9063bbacb94650564f78158e05b3b0cee5e99770970c909a3f29ab924ccd46c1fe67

Malware Config

Extracted

Family

warzonerat

C2

147.124.213.132:5200

Targets

    • Target

      b214cee84b16aeb61636a83879b2fc9a

    • Size

      412KB

    • MD5

      b214cee84b16aeb61636a83879b2fc9a

    • SHA1

      b496aef57c8b1712c7e16abb098c20d544e2c639

    • SHA256

      808471efa1f93a3e6a70c762b8e6d980258c40bb3a6f6aacb08486e64e1ae18f

    • SHA512

      cb3999ed5bfc7164770fbf34d947154a124dedaef59f95d543b0a3ec6d3f9063bbacb94650564f78158e05b3b0cee5e99770970c909a3f29ab924ccd46c1fe67

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks