Overview

overview

10

Static

static

10

tes1.exe

windows7-x64

10

tes1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tes1.exe

  • Size

    132KB

  • Sample

    240727-b5p5nayfnp

  • MD5

    b77ff60d464d3aa97d0432680c468bf5

  • SHA1

    9523926751ef97005e7c87beac04ef74ba353fe2

  • SHA256

    eb71118942d0a74070e815d3aa153cca01c172f4bce9c64fe64b097ce95ec797

  • SHA512

    699bb186b2859460d86ce1cff238665ecb3ed27291e7f8c2d85632e98596a0e31b186096e5fd1d3c77d52b3e5e029f0aa0f0f2a81e20ee8d79010d32627984ac

  • SSDEEP

    3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

Score
10/10
warzoneratdiscoveryinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

194.59.30.96:7771

Targets

    • Target

      tes1.exe

    • Size

      132KB

    • MD5

      b77ff60d464d3aa97d0432680c468bf5

    • SHA1

      9523926751ef97005e7c87beac04ef74ba353fe2

    • SHA256

      eb71118942d0a74070e815d3aa153cca01c172f4bce9c64fe64b097ce95ec797

    • SHA512

      699bb186b2859460d86ce1cff238665ecb3ed27291e7f8c2d85632e98596a0e31b186096e5fd1d3c77d52b3e5e029f0aa0f0f2a81e20ee8d79010d32627984ac

    • SSDEEP

      3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

    Score
    10/10
    warzoneratdiscoveryinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks