Overview

overview

10

Static

static

67e04fe16e...6e.exe

windows7-x64

10

67e04fe16e...6e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    67e04fe16e647e86b2226bae73b17349dfc8c4e8c9521e6caf08557714c2326e.zip

  • Size

    247KB

  • Sample

    221108-3vyslaccf4

  • MD5

    48533df1ba81fe373557910b254a56dc

  • SHA1

    8429118aeb067d17405380d9865257869d72f959

  • SHA256

    6e2222d0f10b93c3c0e333ba3a651576bc01c4ed67e954bf447b466eb96a0d0a

  • SHA512

    f63171c0162993ddb0b392946aa7d4ec10948afb858126e6753636aa06562fa71fd5e06f0e437875c072909ba247cae68d1895ad706c85ff35f50b14d2f6efd6

  • SSDEEP

    6144:Shl3RfquOcEhRPZWIA7eDGjUgfNoUhyHv0MV/6GmfbQHd0Q:K3RdO5hu8DwUg9mh6GsbQHd0Q

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

192.3.111.154:5200

Targets

    • Target

      67e04fe16e647e86b2226bae73b17349dfc8c4e8c9521e6caf08557714c2326e.exe

    • Size

      579KB

    • MD5

      6709be85de46a98a01e1f372eaddf215

    • SHA1

      a8218b7b5ba63c1e01e15ad36ceed331c4949f08

    • SHA256

      67e04fe16e647e86b2226bae73b17349dfc8c4e8c9521e6caf08557714c2326e

    • SHA512

      a266e40d9c0d7d3d88d0e0282f7b1d5bf1a708245ea75b823844121a370b282948129a7c2476ff0c9fac6ced13f95e6eebaedce6ab159e45e9815437b352be4f

    • SSDEEP

      6144:Nvn9rg8XK8UwUAOyaNEnZlVuamiB453ItCCxL17:N68vYYaynVuRiq47L17

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks