Overview

overview

10

Static

static

3

c59eb6d8ac...8b.exe

windows7-x64

10

c59eb6d8ac...8b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94b3f60ce09e1ce59051c6ac3c0910ef.zip

  • Size

    268KB

  • Sample

    240902-asebyswdmk

  • MD5

    f24653a7ff5066fc1c3076f7cdc16445

  • SHA1

    c99850174bb2c546707e9715e59e43ebde27dc46

  • SHA256

    1828e601d797a6f5222d71e7f419d5789b0ec3b7efbe8c8895d9b6c7e27b9a8d

  • SHA512

    e03effb80cecf3c16295faa6404938084745f1e096b5240fc61bcc9f72fc19bc370ef114f0fb5de556001571ce81ea33045546892cf1f3adffce6bea571f88ce

  • SSDEEP

    6144:zpYpg19qK5+QQoxidHQAjTSTzWEprVALtDq3wUqmrRAZhPIznY:BEKkVHQAyR/qQgUhtDY

Score
10/10
warzoneratdiscoveryinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

45.74.4.244:5205

Targets

    • Target

      c59eb6d8ac6774b7a93140189e773bed9c57a8c2a42996b72ccd06c543dc678b

    • Size

      401KB

    • MD5

      94b3f60ce09e1ce59051c6ac3c0910ef

    • SHA1

      b4e4198ee0cc4846a4ef975c2daf62f3ff61b155

    • SHA256

      c59eb6d8ac6774b7a93140189e773bed9c57a8c2a42996b72ccd06c543dc678b

    • SHA512

      4299432cdf56bc96b6e80e5472c51a596676a568dfee64bf538cc7132b9004ed8e7b08dc241e0c6e85df022579441341679853475cbf6eb5c64e10faa4f8b567

    • SSDEEP

      6144:+yLuIbiO66amhdTkgtym01Kci1eeicdryGWc1Zxl8ZTZrU012+saG:s/k7NEm0b6MKec1rlEu1aG

    Score
    10/10
    warzoneratdiscoveryinfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks