Overview

overview

10

Static

static

1edf6239fd...e2.exe

windows7_x64

10

1edf6239fd...e2.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1edf6239fdc16549861e1b187c396ce2
  • Size 392KB
  • Sample210818-5fn3evtx4j
  • SHA256 8defe9e761e45c1d2b7d8aecd4073068f2026d20eff14d247028618bc7e6ed73
  • MD5 SHA1 SHA512
Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

  • warzonerat

C2

  • oklahamaa.ydns.eu:4150

Targets

    • Target
      1edf6239fdc16549861e1b187c396ce2
    • Size 392KB
    • SHA256 8defe9e761e45c1d2b7d8aecd4073068f2026d20eff14d247028618bc7e6ed73
    • MD5 SHA1 SHA512
    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks