Overview

overview

10

Static

static

035ec20b83...7f.exe

windows7_x64

10

035ec20b83...7f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    035ec20b83846152ff2ffb513545aa2cf2d7fb83b81ab1c623ba582c71cd2b7f

  • Size

    592KB

  • Sample

    220528-a2bmesafg8

  • MD5

    71f641159a0b255e20d6af33d1abd416

  • SHA1

    12d5dcb0816ef37a8b38f68e9945661b665a8953

  • SHA256

    035ec20b83846152ff2ffb513545aa2cf2d7fb83b81ab1c623ba582c71cd2b7f

  • SHA512

    b37303e7f823b9299c519af61cb16d03ff1157c69a9077db77344ebf185eff9a92439a1c42e03361ed037e2e8d7821c2345a89db1b37c4faae162aad1234ddff

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

ngray.duckdns.org:3284

Targets

    • Target

      035ec20b83846152ff2ffb513545aa2cf2d7fb83b81ab1c623ba582c71cd2b7f

    • Size

      592KB

    • MD5

      71f641159a0b255e20d6af33d1abd416

    • SHA1

      12d5dcb0816ef37a8b38f68e9945661b665a8953

    • SHA256

      035ec20b83846152ff2ffb513545aa2cf2d7fb83b81ab1c623ba582c71cd2b7f

    • SHA512

      b37303e7f823b9299c519af61cb16d03ff1157c69a9077db77344ebf185eff9a92439a1c42e03361ed037e2e8d7821c2345a89db1b37c4faae162aad1234ddff

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks