General

  • Target

    a5b3a047794886e03b6dbd90a689733e

  • Size

    579KB

  • Sample

    240226-hmc6psfh5t

  • MD5

    a5b3a047794886e03b6dbd90a689733e

  • SHA1

    0ff58bdf40fa6852d2fc5e3d06dcbf5a6a43d8cf

  • SHA256

    eac2062829caef9c99ee196af392009abf34b884ff9c2f909d4e9444cae5e3ae

  • SHA512

    530f5566bc627c0d366647a72d5c6c9b50132ef944edaa792f282af80db6d49de52e43a1a4a8ae46f988d195280fb8dc2d5df4c5cdc7da19af78c4cafacac082

  • SSDEEP

    12288:XUOycCPEyAgcmFcvkrI9rzEs0sxD+ibZD74Djhe4/DIEVuHJub7U2RBVc:EOycpyAJTkEPEs0pibZ3ogeDI7Hkb7B+

Malware Config

Extracted

Family

warzonerat

C2

185.19.85.155:1997

Targets

    • Target

      a5b3a047794886e03b6dbd90a689733e

    • Size

      579KB

    • MD5

      a5b3a047794886e03b6dbd90a689733e

    • SHA1

      0ff58bdf40fa6852d2fc5e3d06dcbf5a6a43d8cf

    • SHA256

      eac2062829caef9c99ee196af392009abf34b884ff9c2f909d4e9444cae5e3ae

    • SHA512

      530f5566bc627c0d366647a72d5c6c9b50132ef944edaa792f282af80db6d49de52e43a1a4a8ae46f988d195280fb8dc2d5df4c5cdc7da19af78c4cafacac082

    • SSDEEP

      12288:XUOycCPEyAgcmFcvkrI9rzEs0sxD+ibZD74Djhe4/DIEVuHJub7U2RBVc:EOycpyAJTkEPEs0pibZ3ogeDI7Hkb7B+

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks