Overview

overview

10

Static

static

10

5f1cc74147...f7.exe

windows7-x64

10

5f1cc74147...f7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f1cc74147ae0c77e872cfd593c705f7.exe

  • Size

    189KB

  • Sample

    221129-en3wzagf2s

  • MD5

    5f1cc74147ae0c77e872cfd593c705f7

  • SHA1

    3de1369f6620717009cf92ae1fe2a5423d66a7e0

  • SHA256

    d132137da263ec4c448f5b39c66c597b78fa21bd6957aa039fd6f84155d0cfdc

  • SHA512

    aa5e6fd2bc71dca076b86ccc3ba766aec247c1a6c87fa3a15c42958f4f9def207877e0e4ee074b20f592b531f4cfc15df9b8df3cfdb1389c17b4e9ba0b950672

  • SSDEEP

    3072:WzPtbXqn6aR97tie5Niae2vl23G3Fzy+fz8LTDQ:Wz1bXq6aR97ViJ2vlz9y+fz8LT

Score
10/10
warzoneratcollectioninfostealerpersistenceratspywarestealer

Malware Config

Targets

    • Target

      5f1cc74147ae0c77e872cfd593c705f7.exe

    • Size

      189KB

    • MD5

      5f1cc74147ae0c77e872cfd593c705f7

    • SHA1

      3de1369f6620717009cf92ae1fe2a5423d66a7e0

    • SHA256

      d132137da263ec4c448f5b39c66c597b78fa21bd6957aa039fd6f84155d0cfdc

    • SHA512

      aa5e6fd2bc71dca076b86ccc3ba766aec247c1a6c87fa3a15c42958f4f9def207877e0e4ee074b20f592b531f4cfc15df9b8df3cfdb1389c17b4e9ba0b950672

    • SSDEEP

      3072:WzPtbXqn6aR97tie5Niae2vl23G3Fzy+fz8LTDQ:Wz1bXq6aR97ViJ2vlz9y+fz8LT

    Score
    10/10
    warzoneratinfostealerpersistenceratcollectionspywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks