Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    132KB

  • Sample

    220918-vb61vsfddr

  • MD5

    81e7f2e0b5e3b75526bf74575f4201a7

  • SHA1

    54a08f5781f83b0f58776222cb8299f865a69bae

  • SHA256

    a9602ca7dcde481b43334f5a5eaa9dda63b645486f79cd022ac40f187a2a1821

  • SHA512

    b799d2932ba653b87439a8848ba76d800442d4a80cbeff85435a965d1c5180b34581b326cfb9142dd96de115944c87e130e4e8416f1405a32767688c55005f1e

  • SSDEEP

    3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

103.147.185.99:5200

Targets

    • Target

      tmp

    • Size

      132KB

    • MD5

      81e7f2e0b5e3b75526bf74575f4201a7

    • SHA1

      54a08f5781f83b0f58776222cb8299f865a69bae

    • SHA256

      a9602ca7dcde481b43334f5a5eaa9dda63b645486f79cd022ac40f187a2a1821

    • SHA512

      b799d2932ba653b87439a8848ba76d800442d4a80cbeff85435a965d1c5180b34581b326cfb9142dd96de115944c87e130e4e8416f1405a32767688c55005f1e

    • SSDEEP

      3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks