Overview

overview

10

Static

static

07c9e053c4...a1.exe

windows7-x64

10

07c9e053c4...a1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07c9e053c40021df38aa0f37a4848da6cd8e2856262cf67c8419100968a7cca1

  • Size

    771KB

  • Sample

    221130-qwq3xshb5t

  • MD5

    d67910879642b78fbb5e49b2c8e89603

  • SHA1

    c37032eb9f9e1ec463c40c1bba4d2d1ac0a66be9

  • SHA256

    07c9e053c40021df38aa0f37a4848da6cd8e2856262cf67c8419100968a7cca1

  • SHA512

    f9e223317a9acf185958e0e7cf783b58a5e805309061740c6c1c428fc45ce02acd2f3c735471b8c874cac98098db4a5174a8e332dd549d22b346b4378e544a26

  • SSDEEP

    12288:j6YdEQV5Je0n2yuBZlS5y+9+MUbM6ZDSRiovHH9goiPeq+8mMtP:L1pn2Nu5J+MUb/ZDMx9wPeq+8myP

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

45.137.22.45:5100

Targets

    • Target

      07c9e053c40021df38aa0f37a4848da6cd8e2856262cf67c8419100968a7cca1

    • Size

      771KB

    • MD5

      d67910879642b78fbb5e49b2c8e89603

    • SHA1

      c37032eb9f9e1ec463c40c1bba4d2d1ac0a66be9

    • SHA256

      07c9e053c40021df38aa0f37a4848da6cd8e2856262cf67c8419100968a7cca1

    • SHA512

      f9e223317a9acf185958e0e7cf783b58a5e805309061740c6c1c428fc45ce02acd2f3c735471b8c874cac98098db4a5174a8e332dd549d22b346b4378e544a26

    • SSDEEP

      12288:j6YdEQV5Je0n2yuBZlS5y+9+MUbM6ZDSRiovHH9goiPeq+8mMtP:L1pn2Nu5J+MUb/ZDMx9wPeq+8myP

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks