Overview

overview

10

Static

static

1

45d0badf0d...60.exe

windows7-x64

10

45d0badf0d...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    45d0badf0d81962d173b3009f3dcb660.exe

  • Size

    688KB

  • Sample

    230326-kywhjahh8w

  • MD5

    45d0badf0d81962d173b3009f3dcb660

  • SHA1

    1a930dd4b42133450ec20f4461fe83abfab00981

  • SHA256

    bba868fe07310c4421085991f00efc87d7874c71780a2e38f17305ed95c73305

  • SHA512

    055bd8beaf7c8fa83ea30da771b01ad0ad288cd687aa127d481a32fc69f7a6738831a043c392dda3fe7c24e0f17a331a36f81fb87d8ed9b265a475d24c39bf92

  • SSDEEP

    12288:aGveLRgNGSD7QK+Vt1FvL/Wl3mcDNT+hU+s2yc1:1edMMXV7FD/uDshUYyc

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

84.38.130.181:5200

Targets

    • Target

      45d0badf0d81962d173b3009f3dcb660.exe

    • Size

      688KB

    • MD5

      45d0badf0d81962d173b3009f3dcb660

    • SHA1

      1a930dd4b42133450ec20f4461fe83abfab00981

    • SHA256

      bba868fe07310c4421085991f00efc87d7874c71780a2e38f17305ed95c73305

    • SHA512

      055bd8beaf7c8fa83ea30da771b01ad0ad288cd687aa127d481a32fc69f7a6738831a043c392dda3fe7c24e0f17a331a36f81fb87d8ed9b265a475d24c39bf92

    • SSDEEP

      12288:aGveLRgNGSD7QK+Vt1FvL/Wl3mcDNT+hU+s2yc1:1edMMXV7FD/uDshUYyc

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks