warzonerat | 3971845bb66080170f9c166e1fcaf497d598dcfc5fbc380f0363711fc73e0580 | Triage

Sharing

General

Target

434c581d692f438caa4dcae3d42c32d4
Size

669KB
Sample

210915-hts6haaae6
MD5

434c581d692f438caa4dcae3d42c32d4
SHA1

6f1fc19c1c796117366d744cd33998c34bab8e6f
SHA256

3971845bb66080170f9c166e1fcaf497d598dcfc5fbc380f0363711fc73e0580
SHA512

a06dbca9c28763005dff82eda81326d455a305d32fffee0dce8b5019faa5aefaf2e15a78c151519ab032723264274c457a516acab3fafbef757714d8ad64b7e0

Score

10^/10

warzonerat infostealer persistence rat spyware stealer

Malware Config

Extracted

Family

warzonerat

C2

pentester01.duckdns.org:60976

Targets

- Target
  
  434c581d692f438caa4dcae3d42c32d4
- Size
  
  669KB
- MD5
  
  434c581d692f438caa4dcae3d42c32d4
- SHA1
  
  6f1fc19c1c796117366d744cd33998c34bab8e6f
- SHA256
  
  3971845bb66080170f9c166e1fcaf497d598dcfc5fbc380f0363711fc73e0580
- SHA512
  
  a06dbca9c28763005dff82eda81326d455a305d32fffee0dce8b5019faa5aefaf2e15a78c151519ab032723264274c457a516acab3fafbef757714d8ad64b7e0
Score

10^/10

warzonerat infostealer persistence rat spyware stealer
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT Payload
  rat
- Blocklisted process makes network request
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Install Root Certificate

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

warzoneratinfostealerpersistenceratspywarestealer