warzonerat | 0f728d5606c62474462db6db9ba75a0261fc7a81c77f58a07a68648ceabccec0 | Triage

Submit
Reports

Overview

overview

Static

static

0dbf2d8823...18.exe

windows7-x64

0dbf2d8823...18.exe

windows10-2004-x64

Sharing

General

Target

0dbf2d88233dc35dd2c37f3e05cba622_JaffaCakes118
Size

2.9MB
Sample

240502-g5zlzsdd69
MD5

0dbf2d88233dc35dd2c37f3e05cba622
SHA1

b57d230180d8b197d9cfd7b996cf8819370fc552
SHA256

0f728d5606c62474462db6db9ba75a0261fc7a81c77f58a07a68648ceabccec0
SHA512

49f7c54e40354b72a1c9b039c0928b7a05402693157fafd3458929292a65fc4d6fe0f39d05fdb468efc108340bb5d628319b5f3fbbe49b33278ffdabd11cdd23
SSDEEP

24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHJ:3Ty7A3mw4gxeOw46fUbNecCCFbNecy

Score

10^/10

warzonerat evasion infostealer persistence rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

0dbf2d88233dc35dd2c37f3e05cba622_JaffaCakes118.exe

Resource

win7-20240221-en

warzonerat evasion infostealer persistence rat

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

0dbf2d88233dc35dd2c37f3e05cba622_JaffaCakes118.exe

Resource

win10v2004-20240419-en

warzonerat evasion infostealer persistence rat

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  0dbf2d88233dc35dd2c37f3e05cba622_JaffaCakes118
- Size
  
  2.9MB
- MD5
  
  0dbf2d88233dc35dd2c37f3e05cba622
- SHA1
  
  b57d230180d8b197d9cfd7b996cf8819370fc552
- SHA256
  
  0f728d5606c62474462db6db9ba75a0261fc7a81c77f58a07a68648ceabccec0
- SHA512
  
  49f7c54e40354b72a1c9b039c0928b7a05402693157fafd3458929292a65fc4d6fe0f39d05fdb468efc108340bb5d628319b5f3fbbe49b33278ffdabd11cdd23
- SSDEEP
  
  24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHJ:3Ty7A3mw4gxeOw46fUbNecCCFbNecy
Score

10^/10

warzonerat evasion infostealer persistence rat
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT payload
  rat
- Modifies Installed Components in the registry
  persistence
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

warzoneratevasioninfostealerpersistencerat

behavioral2

warzoneratevasioninfostealerpersistencerat

© 2018-2024

Terms | Privacy