Overview

overview

10

Static

static

Request Fo...29.exe

windows7-x64

10

Request Fo...29.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Request For RFQ-Quote - Purchase order-#04973579329.exe

  • Size

    332KB

  • Sample

    220930-qv8xcaeehp

  • MD5

    2fa872c29baefef24bd046b7813a049d

  • SHA1

    a1222c09bde48a4949a66df1b10d96eacbc83a37

  • SHA256

    c10a9477615e2070cd7bdfb136a14837607a48538a6301473809ed8cd83fd7c8

  • SHA512

    377a7b74d1e7dcb59cd571c6bd3ed24ee654215d719d20a96fb61a32c27e967f042b9a3b149100c87872dc0ae8923b3d4ebdb11418207ce8153daf1f9daf4ba1

  • SSDEEP

    6144:NfimM71dJOEqCEINXeHCm2WRMCVdKrLPefCoJ8L77:gx32IReT2WRMCi/xh7

Score
10/10
warzoneratcollectioninfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

81.161.229.75:5200

Targets

    • Target

      Request For RFQ-Quote - Purchase order-#04973579329.exe

    • Size

      332KB

    • MD5

      2fa872c29baefef24bd046b7813a049d

    • SHA1

      a1222c09bde48a4949a66df1b10d96eacbc83a37

    • SHA256

      c10a9477615e2070cd7bdfb136a14837607a48538a6301473809ed8cd83fd7c8

    • SHA512

      377a7b74d1e7dcb59cd571c6bd3ed24ee654215d719d20a96fb61a32c27e967f042b9a3b149100c87872dc0ae8923b3d4ebdb11418207ce8153daf1f9daf4ba1

    • SSDEEP

      6144:NfimM71dJOEqCEINXeHCm2WRMCVdKrLPefCoJ8L77:gx32IReT2WRMCi/xh7

    Score
    10/10
    warzoneratinfostealerratcollection

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Drops startup file

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks