Overview

overview

10

Static

static

1

sample.html

windows7-x64

1

sample.html

windows10-2004-x64

10

Resubmissions

19-03-2024 09:13

240319-k6zvxsgf6x 10

19-03-2024 09:08

240319-k38cwsge7z 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sample

  • Size

    88KB

  • Sample

    240319-k6zvxsgf6x

  • MD5

    fa1f40ef09d084500e63cec86333d59c

  • SHA1

    cfcb60bb7ddb345bdcb6505b0eedca58f7e93518

  • SHA256

    cdea3f40ff14e31e8afc0810ea6dfea48d79f5d30dbf2b66673aa89546f40cdb

  • SHA512

    e23475b0d98d736ad84555c6c475d239bee6e6619ead4350b94c1ef60ad02b264d95a5cc48221519984972477ec6be984ea1f9e8f7e2571e2712a2a4620c83cc

  • SSDEEP

    1536:ybQBKbTtHnD3A0vuhGyUfjsfzf04PAPlPkpyXIQkvukuyOct:qHnD3AeuUyUfgfzfNPAPlPkpyXINGY

Score
10/10
warzoneratinfostealerratrezer0

Malware Config

Extracted

Family

warzonerat

C2

168.61.222.215:5400

Targets

    • Target

      sample

    • Size

      88KB

    • MD5

      fa1f40ef09d084500e63cec86333d59c

    • SHA1

      cfcb60bb7ddb345bdcb6505b0eedca58f7e93518

    • SHA256

      cdea3f40ff14e31e8afc0810ea6dfea48d79f5d30dbf2b66673aa89546f40cdb

    • SHA512

      e23475b0d98d736ad84555c6c475d239bee6e6619ead4350b94c1ef60ad02b264d95a5cc48221519984972477ec6be984ea1f9e8f7e2571e2712a2a4620c83cc

    • SSDEEP

      1536:ybQBKbTtHnD3A0vuhGyUfjsfzf04PAPlPkpyXIQkvukuyOct:qHnD3AeuUyUfgfzfNPAPlPkpyXINGY

    Score
    10/10
    warzoneratinfostealerratrezer0

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Warzone RAT payload

      rat

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks