Overview

overview

10

Static

static

3

Order_1503...df.scr

windows7-x64

7

Order_1503...df.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ebcc2fa4fba63365245646c328496820_JaffaCakes118

  • Size

    264KB

  • Sample

    240919-vkyqvazglp

  • MD5

    ebcc2fa4fba63365245646c328496820

  • SHA1

    de10b42f1392974170b6d27470c71dcd4566e8b9

  • SHA256

    e752991d6d0afc4b75df343f9aecd0d5313eface1882b50b72d0457e0bcd4096

  • SHA512

    36c578c5898f456dd4028f11ddf33859b896ca91aab44576fb9215cbca3d2ee086b550cf9cc7da0652f975cf262ef74f3453dc4dbfc1a2c83edd026fbd5b6ea1

  • SSDEEP

    6144:nP+DFeRNO6JrjT/nhfi+NJEFd3YIDsfTtXuZrZN5lCzk2sl:nP+cRfJrv/E+NJEF2duvNXufsl

Score
10/10
warzoneratagilenetdiscoveryinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

openheaven.warzonedns.com:25122

Targets

    • Target

      Order_15032019.pdf.scr

    • Size

      322KB

    • MD5

      bf49ec30267d7324e2f1dbcd5ff2f0cf

    • SHA1

      7ab3fc626912eb493a6a13f0782cf2188033dc52

    • SHA256

      f5442eff0797bd4eec5381f191a07a811b63b8c77fd88f6f65deabf841949e42

    • SHA512

      5f951cdd3d682b837dc4969967876294a401fc05f76464fcff6d82ed4cd3eacc75e28c8d2839c6ec12056123245069b3dc31b32717b046c2d3cf761d4d387caf

    • SSDEEP

      6144:CvVJT9KvY8Iwbd4HqdE8sgJYtZfbGioIS7AwZc6H31UGAhwjDDaExGgkMTZF38cz:CNJTMvfXWHD0YtFbGbFAH6HlTEwjD+UD

    Score
    10/10
    agilenetdiscoverywarzoneratinfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks