warzonerat | f366cb892570b264ce73bd7c818ee214f0e5f00dc008a4dac5fa5cdc095ddab7

General

Target
STATEMENT_OF_ACCOUNT__SOA_.EXE
Size 75KB
Sample220503-jjnnpsfedk
SHA256 f366cb892570b264ce73bd7c818ee214f0e5f00dc008a4dac5fa5cdc095ddab7
MD5 cbecc4ad3e929172705f4407ceece1a3
SHA1 c6e44e98e1686ebe421b1fbf3c0cec9a1d14b510
SHA512 40ea5bf2d63ab3a0a6c70eb5c96125752fe3a3bf9c3a85223dfa90b6ab43f85c764b1c977cc51bfbc80fb65c532782338aa8805c530d2847826f84c87ba54dfb
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

62.197.136.237:55788

Targets

- Target
  STATEMENT_OF_ACCOUNT__SOA_.EXE
- Size 75KB
- SHA256 f366cb892570b264ce73bd7c818ee214f0e5f00dc008a4dac5fa5cdc095ddab7
- MD5 cbecc4ad3e929172705f4407ceece1a3
- SHA1 c6e44e98e1686ebe421b1fbf3c0cec9a1d14b510
- SHA512 40ea5bf2d63ab3a0a6c70eb5c96125752fe3a3bf9c3a85223dfa90b6ab43f85c764b1c977cc51bfbc80fb65c532782338aa8805c530d2847826f84c87ba54dfb
- MD5 SHA1 SHA512
Score

10^/10

warzonerat collection infostealer persistence rat
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT Payload
  rat
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

WarzoneRat, AveMaria

Warzone RAT Payload

Loads dropped DLL

Accesses Microsoft Outlook profiles

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2