Overview

overview

10

Static

static

3

Order_ APR...DF.scr

windows7-x64

10

Order_ APR...DF.scr

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    nOrder_ APRL 310377FIBA00541.z

  • Size

    956KB

  • Sample

    230426-vyl9zacf5s

  • MD5

    fd61fba7947a52f46d16fdf323c26b32

  • SHA1

    19c20acef1058b544e0e57a2af786dc5e5929024

  • SHA256

    82851f54c4fc23e92e24cb1217a523b6fb7e7c1cba70ef55de6cfc61892c35b7

  • SHA512

    9e21e8038ed4862ff78cb52bce55812ce16f41c21967503e61f618ce17595f07d40a8ff8c6fa296893b404ff9f72c63cf5e7dae2cd727f884f3cefdbc7221cff

  • SSDEEP

    24576:SSAzcXXbi74sGm6ekYHL5y4WCWM1hwTHJWabsk:SSjXQ4sGm6XYHV3WCWxp7b5

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

46.183.216.163:24626

Targets

    • Target

      Order_ APRL 310377FIBA00541·PDF.scr

    • Size

      1.6MB

    • MD5

      fdaf9f0b8f08dd76f9093aebe4f605cb

    • SHA1

      fee0b5bed3425667da20dbca9ff7b8a7a9f15a4c

    • SHA256

      c7ab9ad2713d8592d9a8a376632e1aea58652a6dac48cbbcc9003d6a73952a3b

    • SHA512

      684fdbf3ff821985382d9bebcec1e6b194f39fbdcedde0dcabfe3ec09629f7fd617155d0379c9a46c3eb6952436ad41aec30ab862acab1bae1d75900a6e301b0

    • SSDEEP

      24576:KsKdMcaIsLAsHJiV7AEX3aymxcD4qVrcBZLeLdncofSYVTI/DN:KwcmEH9D28Bc1fN

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks