warzonerat | 6534b9213802327bcfb07a0dfca17286e2bed2fbfc977b41911203dc3f430d8a

General

Target
Overdue Invoices for payment.pdf.exe
Size 700KB
Sample220120-ld7whahda5
SHA256 6534b9213802327bcfb07a0dfca17286e2bed2fbfc977b41911203dc3f430d8a
MD5 895b039c1cb9da14bc2cdf4ed78d8b78
SHA1 729fa05d4fcff6f9086ffc8f50f3ffa073a934fe
SHA512 8f7f4dd7afc7f83060551fef9435f64333ac333211f010d2ccb2a98ceb1372cf1615fd2c8f44d3ca8c4e00cbf22cb5b7b31c8db4e2b442cbcccacd8dbfc75fc5
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

62.197.136.188:4178

Targets

- Target
  Overdue Invoices for payment.pdf.exe
- Size 700KB
- SHA256 6534b9213802327bcfb07a0dfca17286e2bed2fbfc977b41911203dc3f430d8a
- MD5 895b039c1cb9da14bc2cdf4ed78d8b78
- SHA1 729fa05d4fcff6f9086ffc8f50f3ffa073a934fe
- SHA512 8f7f4dd7afc7f83060551fef9435f64333ac333211f010d2ccb2a98ceb1372cf1615fd2c8f44d3ca8c4e00cbf22cb5b7b31c8db4e2b442cbcccacd8dbfc75fc5
- MD5 SHA1 SHA512
Score

10^/10

warzonerat infostealer persistence rat
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT Payload
  rat
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

WarzoneRat, AveMaria

Warzone RAT Payload

Loads dropped DLL

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2