warzonerat | 6e2286d2012a0b3268693c1fb3daaaec7aedce34095755db823a6d961dce2e3e

General

Target
1049f535389a2cd97f34d845c3ffc9c8.exe
Size 423KB
Sample220508-tvsf5sfbbj
SHA256 6e2286d2012a0b3268693c1fb3daaaec7aedce34095755db823a6d961dce2e3e
MD5 1049f535389a2cd97f34d845c3ffc9c8
SHA1 b01398f3744ce8bdf94bda95e66def01a9ad8f72
SHA512 946392852c28d0c1c984f71bf6a717551ae80f66d449449c24e6af81d27bd7b0a1f544ae3f48c32d72f62ac059dc5ef2bbe41c6db6fcf7f03fad1267e91d4ef0
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

topimoiofnfiomog.freedynamicdns.org:5207

Targets

- Target
  1049f535389a2cd97f34d845c3ffc9c8.exe
- Size 423KB
- SHA256 6e2286d2012a0b3268693c1fb3daaaec7aedce34095755db823a6d961dce2e3e
- MD5 1049f535389a2cd97f34d845c3ffc9c8
- SHA1 b01398f3744ce8bdf94bda95e66def01a9ad8f72
- SHA512 946392852c28d0c1c984f71bf6a717551ae80f66d449449c24e6af81d27bd7b0a1f544ae3f48c32d72f62ac059dc5ef2bbe41c6db6fcf7f03fad1267e91d4ef0
- MD5 SHA1 SHA512
Score

10^/10

warzonerat infostealer persistence rat
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT Payload
  rat
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

WarzoneRat, AveMaria

Warzone RAT Payload

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2