warzonerat | e8d5095283a32fee5357f6e630c14b2d5362c7cae840696cb0d8a85ebed76676 | Triage

Sharing

General

Target

a081999ab017d1f1354d235391cb521c
Size

113KB
Sample

210713-fgl6yzeeyx
MD5

a081999ab017d1f1354d235391cb521c
SHA1

c5b9ad765d629991996e4279b7a8753c5e49ef91
SHA256

e8d5095283a32fee5357f6e630c14b2d5362c7cae840696cb0d8a85ebed76676
SHA512

ec5986a4345ca564aac94dc1f2bb49a9acc81b8930e4a835c06022beb5cf4cc4e6df27206a2c254ba299f90ba3fdd4756cd2a7b5496b1f28019b434459357cf9

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

publicvm.casacam.net:5200

Targets

- Target
  
  a081999ab017d1f1354d235391cb521c
- Size
  
  113KB
- MD5
  
  a081999ab017d1f1354d235391cb521c
- SHA1
  
  c5b9ad765d629991996e4279b7a8753c5e49ef91
- SHA256
  
  e8d5095283a32fee5357f6e630c14b2d5362c7cae840696cb0d8a85ebed76676
- SHA512
  
  ec5986a4345ca564aac94dc1f2bb49a9acc81b8930e4a835c06022beb5cf4cc4e6df27206a2c254ba299f90ba3fdd4756cd2a7b5496b1f28019b434459357cf9
Score

10^/10

warzonerat infostealer persistence rat
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

warzoneratinfostealerpersistencerat

behavioral2

warzoneratinfostealerpersistencerat