Overview

overview

10

Static

static

7

d3ff54b73d...19.exe

windows7-x64

10

d3ff54b73d...19.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d3ff54b73d0987b740b8c94d6c7d67c3dccc9983f126c574d4184b1788aeaf19

  • Size

    603KB

  • Sample

    230207-g21pwach5t

  • MD5

    a66bff7ab5c211436c320ada78f5b0f8

  • SHA1

    23f2591c836378fae58685600e3ef1a5168494d7

  • SHA256

    d3ff54b73d0987b740b8c94d6c7d67c3dccc9983f126c574d4184b1788aeaf19

  • SHA512

    b657fd19f7b8eb605963861d0caf75c9511f6944a0f051d9433b1a193a6be98d90938df7498d5e9478f30717efa5b211ad984002731f1cfdacbaf8427a8a7e11

  • SSDEEP

    12288:+uhKohUOrOsekKxqTrsrnrn8b8Mw8b8sw8b8Mw8b8sw8Bamhna878baP:FhKBsePcnJ

Score
10/10
warzoneratinfostealerpersistenceratupx

Malware Config

Targets

    • Target

      d3ff54b73d0987b740b8c94d6c7d67c3dccc9983f126c574d4184b1788aeaf19

    • Size

      603KB

    • MD5

      a66bff7ab5c211436c320ada78f5b0f8

    • SHA1

      23f2591c836378fae58685600e3ef1a5168494d7

    • SHA256

      d3ff54b73d0987b740b8c94d6c7d67c3dccc9983f126c574d4184b1788aeaf19

    • SHA512

      b657fd19f7b8eb605963861d0caf75c9511f6944a0f051d9433b1a193a6be98d90938df7498d5e9478f30717efa5b211ad984002731f1cfdacbaf8427a8a7e11

    • SSDEEP

      12288:+uhKohUOrOsekKxqTrsrnrn8b8Mw8b8sw8b8Mw8b8sw8Bamhna878baP:FhKBsePcnJ

    Score
    10/10
    warzoneratinfostealerpersistenceratupx

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks