Overview

overview

10

Static

static

1

abb0a038d3...08.exe

windows7-x64

10

abb0a038d3...08.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e4b8dd5015ff503c145d5d110c0899c.bin

  • Size

    509KB

  • Sample

    230328-cl7q2aac6z

  • MD5

    4c89b91be0e8a2d41dba5b950d50374e

  • SHA1

    d1e17c99cb8c64da75c39238f0280f69b8b5a62b

  • SHA256

    a27a8d34fb5deacd7721064f4f5e4d72bb3e1db5f9003b13a07aabfcb70e54d4

  • SHA512

    1c60e972895adeb3be12fbbcee4db6a1ddfc5f796e80b6d61c264cf526b1d3fb8508d7d4d1e712d0e91ae092ab5055908fc7cd92970afccafed2dea3cabf5315

  • SSDEEP

    12288:ljrAx7zieXzRqianWU/YbnO9vtMrd8RushbwRjgwB7C3IenxNyxCLk:xAxys9an1Ybn8258RuObKjgi23Iox6Co

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

84.38.133.19:5200

Targets

    • Target

      abb0a038d3f1c7c5ea61cdd46e797e1862e5f70d1382d58d59e5404b705bca08.exe

    • Size

      717KB

    • MD5

      9e4b8dd5015ff503c145d5d110c0899c

    • SHA1

      fc17f01106a589943ea2937de4dbd68f5de50cb1

    • SHA256

      abb0a038d3f1c7c5ea61cdd46e797e1862e5f70d1382d58d59e5404b705bca08

    • SHA512

      a3eac22d9935f8d9d421ecd68648eeeaa08a97ed9ec904a851a271dd0fdc0bd236a4b58823f6d7c4c9e7d4ce721678ee2bca60e223406da450d3af5b51b4d2fc

    • SSDEEP

      12288:dIteEGAFDh24NS8Y7GrRybCC4h2M6lavptrnpoZa+fuFtUN4Hhzsc:BIY7GrRy74h8avbrUa+ItPic

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks