Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    343547ccd4990682ba60ae259bf210c4a1078e3de6cee1fcfa48d345d83e23e5

  • Size

    442KB

  • Sample

    211222-vbbjysffe8

  • MD5

    6d5f00a23f0fc84d7e44a9dbcd31e0b4

  • SHA1

    fcfe53ac6c4727a7d711415632882fc7f5569491

  • SHA256

    343547ccd4990682ba60ae259bf210c4a1078e3de6cee1fcfa48d345d83e23e5

  • SHA512

    15cc6af9e8492358ee9041ddb709a87e64723ee41d775ca17ac63a6c1725b006f893313c5cb4bd1cc237dcce6d410900485cd62aa9f4075d308829e1e6994236

Score
10/10
quasarwarzoneratsuccesscollectioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

warzonerat

C2

jerenyankipong.duckdns.org:5200

Extracted

Family

quasar

Version

1.3.0.0

Botnet

SUCCESS

C2

jerenyankipong.duckdns.org:4782

Mutex

MUTEX_jh9iPmixBt74IpSqEj

Attributes
  • encryption_key

    uO9yacYVMmi8921rParX

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    cmd

  • subdirectory

    SubDir

Targets

    • Target

      343547ccd4990682ba60ae259bf210c4a1078e3de6cee1fcfa48d345d83e23e5

    • Size

      442KB

    • MD5

      6d5f00a23f0fc84d7e44a9dbcd31e0b4

    • SHA1

      fcfe53ac6c4727a7d711415632882fc7f5569491

    • SHA256

      343547ccd4990682ba60ae259bf210c4a1078e3de6cee1fcfa48d345d83e23e5

    • SHA512

      15cc6af9e8492358ee9041ddb709a87e64723ee41d775ca17ac63a6c1725b006f893313c5cb4bd1cc237dcce6d410900485cd62aa9f4075d308829e1e6994236

    Score
    10/10
    quasarwarzoneratsuccesscollectioninfostealerpersistenceratspywarestealertrojan

    • Modifies WinLogon for persistence

      persistence

    • Quasar Payload

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Nirsoft

    • Warzone RAT Payload

      rat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks