Overview

overview

10

Static

static

1

f9c10dc1e0...6f.exe

windows7_x64

10

f9c10dc1e0...6f.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f9c10dc1e0d3c6cca07a5f5ec2d4196f.exe
  • Size 535KB
  • Sample211207-pphmjahbdr
  • SHA256 e53117bb9ee3d0c9bfd3d94758b9d54c824776bc594549801bcae621962590fd
  • MD5 SHA1 SHA512
Score
10/10
warzoneratcollectioninfostealerratspywarestealer

Malware Config

Extracted

Family

  • warzonerat

C2

  • 172.245.119.60:5200

Targets

    • Target
      f9c10dc1e0d3c6cca07a5f5ec2d4196f.exe
    • Size 535KB
    • SHA256 e53117bb9ee3d0c9bfd3d94758b9d54c824776bc594549801bcae621962590fd
    • MD5 SHA1 SHA512
    Score
    10/10
    warzoneratinfostealerratcollectionspywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks