Overview

overview

10

Static

static

3df212b133...b8.exe

windows7-x64

10

3df212b133...b8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3df212b13323638a741a6febc79f2e426775adde00e486bc52624a23da1c53b8

  • Size

    1.8MB

  • Sample

    221122-jn22wshh21

  • MD5

    61bbdb549ccbc81047a83e195b00a38b

  • SHA1

    96b4d39428e9ddff6737cd3944b303f169078ebe

  • SHA256

    3df212b13323638a741a6febc79f2e426775adde00e486bc52624a23da1c53b8

  • SHA512

    d0c83db4127ac94a01cccc06492aed8e69d69e0cbffb602debbb67a2bbe3037221d8659bfd4987c8da06d7dcdb926eb5b65653385197fa3632c5a19f72a02633

  • SSDEEP

    12288:ej33yzo7xhMSK4ftKDjtkii0uuDVqMnoV8WUu1HHGYnjNVoWuLD/bfsycN01/Rn:ejyQoDhxjnoV8WUu1HmoknJ

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

192.3.111.154:5200

Targets

    • Target

      3df212b13323638a741a6febc79f2e426775adde00e486bc52624a23da1c53b8

    • Size

      1.8MB

    • MD5

      61bbdb549ccbc81047a83e195b00a38b

    • SHA1

      96b4d39428e9ddff6737cd3944b303f169078ebe

    • SHA256

      3df212b13323638a741a6febc79f2e426775adde00e486bc52624a23da1c53b8

    • SHA512

      d0c83db4127ac94a01cccc06492aed8e69d69e0cbffb602debbb67a2bbe3037221d8659bfd4987c8da06d7dcdb926eb5b65653385197fa3632c5a19f72a02633

    • SSDEEP

      12288:ej33yzo7xhMSK4ftKDjtkii0uuDVqMnoV8WUu1HHGYnjNVoWuLD/bfsycN01/Rn:ejyQoDhxjnoV8WUu1HmoknJ

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks