Overview

overview

10

Static

static

3

fcfba5fc53...18.exe

windows7-x64

10

fcfba5fc53...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcfba5fc5337239796cb5688a092b405_JaffaCakes118

  • Size

    315KB

  • Sample

    240420-ry4x8sag35

  • MD5

    fcfba5fc5337239796cb5688a092b405

  • SHA1

    6b95ec2b50e68b585f364b6ddf951019293f2e86

  • SHA256

    760dad5aef9e1024568a7a80a04e8ecea1babfb889eb134515d4a20747e96ace

  • SHA512

    d8b201ff4a1cfe693dc1fb351b0fb21ea537556136842a615b0bafb6c5de94e65e95f5909358d5eaefcaabdd959c8bae26dd44bd7936c2c7e2717688320315ee

  • SSDEEP

    6144:s+fiVFI8E2KgTr6UqNR3L/P6tYHcVarCLWqzWyI:Vqo8EFgTmBX3z6tWJrCjzWyI

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

graceandfavour.ddns.net:5522

Targets

    • Target

      fcfba5fc5337239796cb5688a092b405_JaffaCakes118

    • Size

      315KB

    • MD5

      fcfba5fc5337239796cb5688a092b405

    • SHA1

      6b95ec2b50e68b585f364b6ddf951019293f2e86

    • SHA256

      760dad5aef9e1024568a7a80a04e8ecea1babfb889eb134515d4a20747e96ace

    • SHA512

      d8b201ff4a1cfe693dc1fb351b0fb21ea537556136842a615b0bafb6c5de94e65e95f5909358d5eaefcaabdd959c8bae26dd44bd7936c2c7e2717688320315ee

    • SSDEEP

      6144:s+fiVFI8E2KgTr6UqNR3L/P6tYHcVarCLWqzWyI:Vqo8EFgTmBX3z6tWJrCjzWyI

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks