Overview

overview

10

Static

static

1

Invoice fo...nt.exe

windows7-x64

10

Invoice fo...nt.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Invoice for payment.exe

  • Size

    914KB

  • Sample

    230208-je9elshf45

  • MD5

    c0c37fc1cd8f4df3db73cb04591b3158

  • SHA1

    bd947aab03c4d50ab8ae66c6cdf1a9d8fcd9efb9

  • SHA256

    66f870824ac16c87c82cd98234a146bbd2963ffe01a7bfef00cc2d0c8d8356cc

  • SHA512

    e2e0801e8c4cc50f7db8eb43a618df3c9cacab74fdbe77a6a48aedf9b1429bf54d66873f487e83298c55a1b7ce8a26a989f8469477632b08ddda95b4c0dada45

  • SSDEEP

    12288:a3WlV/DfrpszP4M/Qe0iId1ltMq+LwNFCXCuqdhYNWf3yTW41KCdsaiHdH6hv:plpDTpWwMYeqaqVFCihY43+W4ivdHu

Score
10/10
warzoneratinfostealerrat

Malware Config

Targets

    • Target

      Invoice for payment.exe

    • Size

      914KB

    • MD5

      c0c37fc1cd8f4df3db73cb04591b3158

    • SHA1

      bd947aab03c4d50ab8ae66c6cdf1a9d8fcd9efb9

    • SHA256

      66f870824ac16c87c82cd98234a146bbd2963ffe01a7bfef00cc2d0c8d8356cc

    • SHA512

      e2e0801e8c4cc50f7db8eb43a618df3c9cacab74fdbe77a6a48aedf9b1429bf54d66873f487e83298c55a1b7ce8a26a989f8469477632b08ddda95b4c0dada45

    • SSDEEP

      12288:a3WlV/DfrpszP4M/Qe0iId1ltMq+LwNFCXCuqdhYNWf3yTW41KCdsaiHdH6hv:plpDTpWwMYeqaqVFCihY43+W4ivdHu

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks