General

  • Target

    74f0c1aa1a2baf6ffdfceebb15812f4f3543a47ad2e60eefa7b7a348337051ec.exe

  • Size

    113KB

  • Sample

    230227-k1lfcacg42

  • MD5

    6d8523a86a6b8522712823b3491a0159

  • SHA1

    db9284abaf3f1bbf9fd22ec6032a29b15a713164

  • SHA256

    74f0c1aa1a2baf6ffdfceebb15812f4f3543a47ad2e60eefa7b7a348337051ec

  • SHA512

    c36f090eeb14c80a82bd56b9d303554ad86e46ac548f8f454d3f3cfd2e8691538793b1d601202b376e1552ab3a345468026fab9894f6aa4a52fbb9bdaf06b3c4

  • SSDEEP

    1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0

Malware Config

Extracted

Family

warzonerat

C2

telenaxty.ddns.net:7706

Targets

    • Target

      74f0c1aa1a2baf6ffdfceebb15812f4f3543a47ad2e60eefa7b7a348337051ec.exe

    • Size

      113KB

    • MD5

      6d8523a86a6b8522712823b3491a0159

    • SHA1

      db9284abaf3f1bbf9fd22ec6032a29b15a713164

    • SHA256

      74f0c1aa1a2baf6ffdfceebb15812f4f3543a47ad2e60eefa7b7a348337051ec

    • SHA512

      c36f090eeb14c80a82bd56b9d303554ad86e46ac548f8f454d3f3cfd2e8691538793b1d601202b376e1552ab3a345468026fab9894f6aa4a52fbb9bdaf06b3c4

    • SSDEEP

      1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks