warzonerat | 5d5e419a42d86763932c38d996c8e59c0b30e093bddcd5cb2cf09c07635b7a31 | Triage

Submit
Reports

Overview

overview

Static

static

5d5e419a42...31.exe

windows7-x64

5d5e419a42...31.exe

windows10-2004-x64

Sharing

General

Target

5d5e419a42d86763932c38d996c8e59c0b30e093bddcd5cb2cf09c07635b7a31
Size

216KB
Sample

221122-jpjlyaee72
MD5

4eac968a4fcd0e6bad79ca6eecbd08d8
SHA1

a1f8bc409f3d0df06094a5e389bf71be24f4b855
SHA256

5d5e419a42d86763932c38d996c8e59c0b30e093bddcd5cb2cf09c07635b7a31
SHA512

380b7f4519feab142495ef84f0260c1d29370acf641990df81184fdfb918070a86e8e0e62b99704ce2b0faf7ccd6cfc0eb7678288d914e351ea00eb486c8aa98
SSDEEP

6144:HKcOrIV4ILN3t1cNCUUUx/9ygRC6LcuD:HKcOrIV753t1cso/XUC

Score

10^/10

warzonerat infostealer persistence rat

Static task

static1

Behavioral task

behavioral1

Sample

5d5e419a42d86763932c38d996c8e59c0b30e093bddcd5cb2cf09c07635b7a31.exe

Resource

win7-20221111-en

warzonerat infostealer persistence rat

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

5d5e419a42d86763932c38d996c8e59c0b30e093bddcd5cb2cf09c07635b7a31.exe

Resource

win10v2004-20220812-en

warzonerat infostealer persistence rat

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Extracted

Family

warzonerat

C2

danbochie.dynv6.net:5200

Targets

- Target
  
  5d5e419a42d86763932c38d996c8e59c0b30e093bddcd5cb2cf09c07635b7a31
- Size
  
  216KB
- MD5
  
  4eac968a4fcd0e6bad79ca6eecbd08d8
- SHA1
  
  a1f8bc409f3d0df06094a5e389bf71be24f4b855
- SHA256
  
  5d5e419a42d86763932c38d996c8e59c0b30e093bddcd5cb2cf09c07635b7a31
- SHA512
  
  380b7f4519feab142495ef84f0260c1d29370acf641990df81184fdfb918070a86e8e0e62b99704ce2b0faf7ccd6cfc0eb7678288d914e351ea00eb486c8aa98
- SSDEEP
  
  6144:HKcOrIV4ILN3t1cNCUUUx/9ygRC6LcuD:HKcOrIV753t1cso/XUC
Score

10^/10

warzonerat infostealer persistence rat
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT payload
  rat
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

warzoneratinfostealerpersistencerat

behavioral2

warzoneratinfostealerpersistencerat

© 2018-2024

Terms | Privacy