Overview

overview

10

Static

static

391c3bc7f5...85.exe

windows7_x64

10

391c3bc7f5...85.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    391c3bc7f5534306976f645db21ff085.exe
  • Size 473KB
  • Sample210727-zy711adele
  • SHA256 0618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87
  • MD5 SHA1 SHA512
Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

  • warzonerat

C2

  • ghjklhgteg.strangled.net:6703

Targets

    • Target
      391c3bc7f5534306976f645db21ff085.exe
    • Size 473KB
    • SHA256 0618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87
    • MD5 SHA1 SHA512
    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks