Overview

overview

10

Static

static

81de49ca23...1b.exe

windows7_x64

10

81de49ca23...1b.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    81de49ca238aa13eec9d1dd49934dc1b
  • Size 939KB
  • Sample220401-sraw9addd7
  • SHA256 ed26cf7c1e212b911017851bdd62dbddd9ebeaabc1a7c39a85780cfe2159a66b
  • MD5 SHA1 SHA512
Score
10/10
modiloaderwarzoneratinfostealerpersistencerattrojan

Malware Config

Extracted

Family

  • warzonerat

C2

  • gerogexcsdf234234sdfsvxc341242324.publicvm.com:4200

Targets

    • Target
      81de49ca238aa13eec9d1dd49934dc1b
    • Size 939KB
    • SHA256 ed26cf7c1e212b911017851bdd62dbddd9ebeaabc1a7c39a85780cfe2159a66b
    • MD5 SHA1 SHA512
    Score
    10/10
    modiloaderpersistencetrojanwarzoneratinfostealerrat

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks