General

  • Target

    Warzn.exe

  • Size

    132KB

  • Sample

    240911-gy1kpswelr

  • MD5

    c6a0b7ced53b767d8a4b6592afef48ae

  • SHA1

    f190204d96db2e0a6643d704cc972048ab379f02

  • SHA256

    d4d2f7fc0cabfd18f77278a4f2e82c7a2b9d94189f05f204874f4cc66806c5b5

  • SHA512

    1a11cffed5a2d7886cc54034c897715b5d669c5b791dccd65bb242ea40d7c5394430b94874dc21f42bb804393cd1589baf26204b04ee60308406753ff4b59eec

  • SSDEEP

    3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

Malware Config

Extracted

Family

warzonerat

C2

147.78.103.115:4449

Targets

    • Target

      Warzn.exe

    • Size

      132KB

    • MD5

      c6a0b7ced53b767d8a4b6592afef48ae

    • SHA1

      f190204d96db2e0a6643d704cc972048ab379f02

    • SHA256

      d4d2f7fc0cabfd18f77278a4f2e82c7a2b9d94189f05f204874f4cc66806c5b5

    • SHA512

      1a11cffed5a2d7886cc54034c897715b5d669c5b791dccd65bb242ea40d7c5394430b94874dc21f42bb804393cd1589baf26204b04ee60308406753ff4b59eec

    • SSDEEP

      3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

MITRE ATT&CK Enterprise v15

Tasks