Overview

overview

10

Static

static

85750367cd...86.exe

windows7-x64

10

85750367cd...86.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    85750367cd487007195495632df84a86

  • Size

    718KB

  • Sample

    221125-xa7xwaaf2x

  • MD5

    85750367cd487007195495632df84a86

  • SHA1

    e234502cd367222b7d17b936e0560272a07e6686

  • SHA256

    2ff7eb4c6d920d8e192fc21e83ee7297050b782b009da077a5c44aa29ae7be71

  • SHA512

    d12690829208f27de02d3c57ffd8adbef3c531758b6c42390b6c76160ae3a75dec7f7dd8ffbfd4ac40220aab8204b5a97308801661672ecf8c20bb0b2a1ad203

  • SSDEEP

    12288:j+lsOL/GXh8L74mBfNUstzoEJqPttqCgsshHgP+imH4kX8oSpATsSM6SF0BOWYKh:KM+L74mBfNUstzoJPttqRx0DvPi3O0kc

Score
10/10
warzoneratcollectioninfostealerpersistenceratspywarestealer

Malware Config

Targets

    • Target

      85750367cd487007195495632df84a86

    • Size

      718KB

    • MD5

      85750367cd487007195495632df84a86

    • SHA1

      e234502cd367222b7d17b936e0560272a07e6686

    • SHA256

      2ff7eb4c6d920d8e192fc21e83ee7297050b782b009da077a5c44aa29ae7be71

    • SHA512

      d12690829208f27de02d3c57ffd8adbef3c531758b6c42390b6c76160ae3a75dec7f7dd8ffbfd4ac40220aab8204b5a97308801661672ecf8c20bb0b2a1ad203

    • SSDEEP

      12288:j+lsOL/GXh8L74mBfNUstzoEJqPttqCgsshHgP+imH4kX8oSpATsSM6SF0BOWYKh:KM+L74mBfNUstzoJPttqRx0DvPi3O0kc

    Score
    10/10
    warzoneratinfostealerpersistenceratcollectionspywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks