Overview

overview

10

Static

static

5

83ff194358...18.exe

windows7-x64

10

83ff194358...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    83ff1943580becc011ab78e05d14a695_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240530-m6hmrafh93

  • MD5

    83ff1943580becc011ab78e05d14a695

  • SHA1

    bf7e0eb85e11cc1aa3772b08009f10fdeff87eed

  • SHA256

    f365e777bdaf244296a416ff1f00438e804c51c3d9167dcf81b5904cf3a1fb07

  • SHA512

    e2d5fe523d3621de5f0eda438df20280db4b3475e49a12a3e05ee782adc545332f76bee301601dae376b63dff9c31e8645207e493b7d74402fb0fd5bb029c571

  • SSDEEP

    24576:Cu6J33O0c+JY5UZ+XC0kGso6FaQqH/ao0ncVZatnJb56lZhfYWY:ku0c++OCvkGs9FaJuEaJJbMVY

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Targets

    • Target

      83ff1943580becc011ab78e05d14a695_JaffaCakes118

    • Size

      1.4MB

    • MD5

      83ff1943580becc011ab78e05d14a695

    • SHA1

      bf7e0eb85e11cc1aa3772b08009f10fdeff87eed

    • SHA256

      f365e777bdaf244296a416ff1f00438e804c51c3d9167dcf81b5904cf3a1fb07

    • SHA512

      e2d5fe523d3621de5f0eda438df20280db4b3475e49a12a3e05ee782adc545332f76bee301601dae376b63dff9c31e8645207e493b7d74402fb0fd5bb029c571

    • SSDEEP

      24576:Cu6J33O0c+JY5UZ+XC0kGso6FaQqH/ao0ncVZatnJb56lZhfYWY:ku0c++OCvkGs9FaJuEaJJbMVY

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks