Overview

overview

10

Static

static

8

5dbd48a788...0e.exe

windows7-x64

10

5dbd48a788...0e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e

  • Size

    703KB

  • Sample

    221130-xeszhshe4v

  • MD5

    b3d80e279422e9a2fccc6eb9b199502c

  • SHA1

    d080ae1c3fca9ac92fc51a8b38521c68dcbfa769

  • SHA256

    5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e

  • SHA512

    10e4e2a7fd3824abe301650822aa183f7ffc6c415338f9fe36fe219f155b5fe3a1900b4cf5d2fe1a207ebf392488c7ac699ff0fd1cd6a21b79a90741d1ec610e

  • SSDEEP

    12288:1YV6MorX7qzuC3QHO9FQVHPF51jgclbrqkLOdb4A9GAq3kF3h4i7alIV:qBXu9HGaVHFqky94J/32CU

Score
10/10
warzoneratinfostealerratupx

Malware Config

Extracted

Family

warzonerat

C2

193.56.28.104:5200

Targets

    • Target

      5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e

    • Size

      703KB

    • MD5

      b3d80e279422e9a2fccc6eb9b199502c

    • SHA1

      d080ae1c3fca9ac92fc51a8b38521c68dcbfa769

    • SHA256

      5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e

    • SHA512

      10e4e2a7fd3824abe301650822aa183f7ffc6c415338f9fe36fe219f155b5fe3a1900b4cf5d2fe1a207ebf392488c7ac699ff0fd1cd6a21b79a90741d1ec610e

    • SSDEEP

      12288:1YV6MorX7qzuC3QHO9FQVHPF51jgclbrqkLOdb4A9GAq3kF3h4i7alIV:qBXu9HGaVHFqky94J/32CU

    Score
    10/10
    warzoneratinfostealerratupx

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks