Overview

overview

10

Static

static

1

ORDER-230814AF.vbs

windows7-x64

8

ORDER-230814AF.vbs

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ORDER-230814AF.vbs
  • Size 9KB
  • Sample230815-pjw8qsaf77
  • SHA256 5502c7306e749b3a59e5c8b35d7e3b21e397ac0a98092519a19e1c1de2ce1de3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
warzoneratwshratinfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • warzonerat

C2

  • chongmei33.publicvm.com:49746

Extracted

Family

  • wshrat

C2

  • http://chongmei33.publicvm.com:7045

Targets

    • Target
      ORDER-230814AF.vbs
    • Size 9KB
    • SHA256 5502c7306e749b3a59e5c8b35d7e3b21e397ac0a98092519a19e1c1de2ce1de3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    warzoneratwshratinfostealerpersistenceratspywarestealertrojan

    • WSHRAT

      WSHRAT is a variant of Houdini worm and has vbs and js variants.

      trojanwshrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Blocklisted process makes network request

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks