warzonerat | bdb9f13b558b246d0bd132e04396c6849994b6261821ffaba03bec32b74da7c4

General

Target

Cracked Wave.exe
Size

18.2MB
Sample

240726-tezkhsxhjj
MD5

08f7681197b9c8cda643216a9ea4a167
SHA1

620a0cf75b25d6cea903af33ae33fb8ba8f838dd
SHA256

bdb9f13b558b246d0bd132e04396c6849994b6261821ffaba03bec32b74da7c4
SHA512

0462388b949bbbd5df7bc256bdfd0a88f336a480a2abe0d610fe525ecf6ccb277e8d17a5040761fa6281f2b0cdd6ba2be0e8245b659173e7a1155445c600cc0d
SSDEEP

393216:GMWct7CVTdjUugY9VDP7JMEEyJp7HUgHkzMmsW0W3WWRqusbMGCNFxHWU:PC1djUugOVDP7JM5yJxULAjBZMGyF5

Score

10^/10

Malware Config

Targets

- Target
  
  Cracked Wave.exe
- Size
  
  18.2MB
- MD5
  
  08f7681197b9c8cda643216a9ea4a167
- SHA1
  
  620a0cf75b25d6cea903af33ae33fb8ba8f838dd
- SHA256
  
  bdb9f13b558b246d0bd132e04396c6849994b6261821ffaba03bec32b74da7c4
- SHA512
  
  0462388b949bbbd5df7bc256bdfd0a88f336a480a2abe0d610fe525ecf6ccb277e8d17a5040761fa6281f2b0cdd6ba2be0e8245b659173e7a1155445c600cc0d
- SSDEEP
  
  393216:GMWct7CVTdjUugY9VDP7JMEEyJp7HUgHkzMmsW0W3WWRqusbMGCNFxHWU:PC1djUugOVDP7JM5yJxULAjBZMGyF5
Score

10^/10

warzonerat credential_access defense_evasion discovery execution infostealer persistence pyinstaller rat spyware stealer
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Warzone RAT payload
  rat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1