Overview

overview

10

Static

static

1

z63DATASHEET.exe

windows7-x64

10

z63DATASHEET.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    z63DATASHEET.exe

  • Size

    161KB

  • Sample

    230324-qext5see22

  • MD5

    63bd8934c91736c0730f84dc84ac65f7

  • SHA1

    d44d2435eda49dc2706b7b5219898ef6d86689c3

  • SHA256

    85490cf0fc3a4ab7db8b39dae6b341a4f99aec3f84ed12816f85759aea900e74

  • SHA512

    a9ee8fb5c2130c0f445e7510c06372d72638087019016a2adb7d9f0619d66bae3c3e36aacbfba21fc1c8841c52c9b6f58ffe337646594c2d8d18f4296795c32d

  • SSDEEP

    3072:x8r8NJzhdWVl7nqHHdiFSBFRRwh9J9vZiEPUv6S0:xw81nKl7srF7whVhHUS

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

91.193.75.142:5234

Targets

    • Target

      z63DATASHEET.exe

    • Size

      161KB

    • MD5

      63bd8934c91736c0730f84dc84ac65f7

    • SHA1

      d44d2435eda49dc2706b7b5219898ef6d86689c3

    • SHA256

      85490cf0fc3a4ab7db8b39dae6b341a4f99aec3f84ed12816f85759aea900e74

    • SHA512

      a9ee8fb5c2130c0f445e7510c06372d72638087019016a2adb7d9f0619d66bae3c3e36aacbfba21fc1c8841c52c9b6f58ffe337646594c2d8d18f4296795c32d

    • SSDEEP

      3072:x8r8NJzhdWVl7nqHHdiFSBFRRwh9J9vZiEPUv6S0:xw81nKl7srF7whVhHUS

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks