warzonerat | 2cc79fa32863d6c2b6e88ef5aabb50174187a3e22efab33c44e4ade2571e3434

General

Target
SecuriteInfo.com.Variant.MSILPerseus.1689.11411.16068
Size 272KB
Sample220414-1eq2psdgfq
SHA256 2cc79fa32863d6c2b6e88ef5aabb50174187a3e22efab33c44e4ade2571e3434
MD5 b5a7acfdb754e4006243c33a807a239a
SHA1 634a6d9736bc39c2e5d419b43e1b7af8fdbac8a6
SHA512 cd9db607cd3ad07e35f465eda62c4208365ff72d76d146a4833b5bdec48fd552ea0f17b138d2c7dd710f9d54c41f3d4ddc3f728b5e49f5c15b2652e0cd3e7e56
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

topimoiofnfiomog.freedynamicdns.org:5207

Targets

- Target
  SecuriteInfo.com.Variant.MSILPerseus.1689.11411.16068
- Size 272KB
- SHA256 2cc79fa32863d6c2b6e88ef5aabb50174187a3e22efab33c44e4ade2571e3434
- MD5 b5a7acfdb754e4006243c33a807a239a
- SHA1 634a6d9736bc39c2e5d419b43e1b7af8fdbac8a6
- SHA512 cd9db607cd3ad07e35f465eda62c4208365ff72d76d146a4833b5bdec48fd552ea0f17b138d2c7dd710f9d54c41f3d4ddc3f728b5e49f5c15b2652e0cd3e7e56
- MD5 SHA1 SHA512
Score

10^/10

warzonerat infostealer persistence rat
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT Payload
  rat
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

WarzoneRat, AveMaria

Warzone RAT Payload

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2