Overview

overview

10

Static

static

3

68ad6e5f63...18.exe

windows7-x64

10

68ad6e5f63...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    68ad6e5f63c9d619c4eb79a9558f0ab8_JaffaCakes118

  • Size

    296KB

  • Sample

    240522-z7lr1shc67

  • MD5

    68ad6e5f63c9d619c4eb79a9558f0ab8

  • SHA1

    1b315636cefd8f5bf68a66eafc771c479f9e704b

  • SHA256

    158e558014275775a5989940be4d8f2f2d5fb1fbd809e2004de22e1a9151920c

  • SHA512

    28bdcfe1e4d1bc9033e17fa5b063b002c636b6e3aa173cb746696c521b84837713bd4a0233ac5b9bea6c4ba3dcf0433c42cc4f5a4bff91cc04ab94e182029a36

  • SSDEEP

    6144:4lRNjULnQYF0BQX4maVu81pY03LCQKzNCSLzBKPt:4lRNALQYF0B1rpY0bCJEiet

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

149.28.115.223:6565

Targets

    • Target

      68ad6e5f63c9d619c4eb79a9558f0ab8_JaffaCakes118

    • Size

      296KB

    • MD5

      68ad6e5f63c9d619c4eb79a9558f0ab8

    • SHA1

      1b315636cefd8f5bf68a66eafc771c479f9e704b

    • SHA256

      158e558014275775a5989940be4d8f2f2d5fb1fbd809e2004de22e1a9151920c

    • SHA512

      28bdcfe1e4d1bc9033e17fa5b063b002c636b6e3aa173cb746696c521b84837713bd4a0233ac5b9bea6c4ba3dcf0433c42cc4f5a4bff91cc04ab94e182029a36

    • SSDEEP

      6144:4lRNjULnQYF0BQX4maVu81pY03LCQKzNCSLzBKPt:4lRNALQYF0B1rpY0bCJEiet

    Score
    10/10
    warzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks