Overview

overview

10

Static

static

3

Hsbct872....exe

windows7-x64

10

Hsbct872....exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bea199bb7934b7cb003cf176d4ec99b3_JaffaCakes118

  • Size

    552KB

  • Sample

    240824-p4q78a1brh

  • MD5

    bea199bb7934b7cb003cf176d4ec99b3

  • SHA1

    3de470b801c07ff7799d0acc44719e32bd6df9bb

  • SHA256

    7b993630329ea51c6d1c337f2bf7aea1c036c7eef0329d9d3f9cee303175744e

  • SHA512

    6835404075428adc8a2649265e720a3cc834c260f5d301d8748772c522553a3d726f752b272a740d23828a1093df16a7942adb9e410cfed049255b9454642c21

  • SSDEEP

    12288:tXwvq5Uh9A35+JQp0l2bVB4zYCLUC5QoM0Ur3:dO9ALp0l3VLV5QH0C

Score
10/10
warzoneratdiscoveryinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

194.5.97.116:1360

Targets

    • Target

      Hsbct872....exe

    • Size

      779KB

    • MD5

      29a700f72e096f9c0e8b8aa070bc635e

    • SHA1

      9445efb9a40f45d1780993500dbf7c589d5dfdc1

    • SHA256

      6a29b861af5094143b6db38ff27f50c349a12bb1112d1b5af67b7fad47632d4c

    • SHA512

      d8436fa8a9d0b29631ce666f796d6c93123c38ee65b696daec7bf1de00cc97a0a68c3211d971babf73b9ad191dca78304e022af214f7efea6551444a3cc34a91

    • SSDEEP

      12288:jZ9RbZU79Ar5KJKp07ebVHwzYCxYC5cOFcEHtkOUR8PL5y6nnjqKoe:FG9Avp07BVxZ5N26nnjqKoe

    Score
    10/10
    warzoneratdiscoveryinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks