Overview

overview

10

Static

static

7

f94cc4a8bc...18.exe

windows7-x64

10

f94cc4a8bc...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f94cc4a8bc7778ad06c46dea2fcae015_JaffaCakes118

  • Size

    1.9MB

  • Sample

    240419-cw5peseb85

  • MD5

    f94cc4a8bc7778ad06c46dea2fcae015

  • SHA1

    3088cb27fb933cdffebe5d365fa8ed0d1169379a

  • SHA256

    65ed67e61818f348fd59b7dbb9e88935f7da64c185965e3d597ea617b3ff35e1

  • SHA512

    8db7f3d3cce11925ccf79447bdf2ed518b355d574346f7a084c1cf972269843fca49f336ff9e65a9e526558243901786e03d3cde48bfa1a6000c724fb1ce19c7

  • SSDEEP

    49152:zhfpWBeokXFpubqkfqNng8V77EnBn7DDh2regl3vy+QgyF3Flqv3fhrs3MrqDqYr:lYMBXb+0nf7Cn7vUeg/QP+3WMze

Score
10/10
warzoneratinfostealerratupx

Malware Config

Extracted

Family

warzonerat

C2

185.140.53.185:2844

Targets

    • Target

      f94cc4a8bc7778ad06c46dea2fcae015_JaffaCakes118

    • Size

      1.9MB

    • MD5

      f94cc4a8bc7778ad06c46dea2fcae015

    • SHA1

      3088cb27fb933cdffebe5d365fa8ed0d1169379a

    • SHA256

      65ed67e61818f348fd59b7dbb9e88935f7da64c185965e3d597ea617b3ff35e1

    • SHA512

      8db7f3d3cce11925ccf79447bdf2ed518b355d574346f7a084c1cf972269843fca49f336ff9e65a9e526558243901786e03d3cde48bfa1a6000c724fb1ce19c7

    • SSDEEP

      49152:zhfpWBeokXFpubqkfqNng8V77EnBn7DDh2regl3vy+QgyF3Flqv3fhrs3MrqDqYr:lYMBXb+0nf7Cn7vUeg/QP+3WMze

    Score
    10/10
    warzoneratinfostealerratupx

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks