warzonerat | b8572015a663ca716c590a9f4713f7826bcffae45611055494f02e7614cf0fd9 | Triage

Submit
Reports

Overview

overview

Static

static

b8572015a6...9N.exe

windows7-x64

b8572015a6...9N.exe

windows10-2004-x64

Sharing

General

Target

b8572015a663ca716c590a9f4713f7826bcffae45611055494f02e7614cf0fd9N
Size

2.9MB
Sample

240923-fzlbqsxcmk
MD5

3b641a7f885496c8b0b1d7fca32476d0
SHA1

b2dfa97f4d79bdffd748e6c2294d8d32e3a9cecf
SHA256

b8572015a663ca716c590a9f4713f7826bcffae45611055494f02e7614cf0fd9
SHA512

311f9091122aaf8d31b31a09380ba33f7fd86cd825437048e855b8ffc779232fb378693d441f5f071f5c77c5b6f504990fcbd3ab1f1f20d83fdf8ddf591e2682
SSDEEP

24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHS:7v97AXmw4gxeOw46fUbNecCCFbNecf

Score

10^/10

warzonerat discovery evasion infostealer persistence rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

b8572015a663ca716c590a9f4713f7826bcffae45611055494f02e7614cf0fd9N.exe

Resource

win7-20240903-en

warzonerat discovery evasion infostealer persistence rat

windows7-x64

16 signatures

120 seconds

Behavioral task

behavioral2

Sample

b8572015a663ca716c590a9f4713f7826bcffae45611055494f02e7614cf0fd9N.exe

Resource

win10v2004-20240802-en

warzonerat discovery evasion infostealer persistence rat

windows10-2004-x64

15 signatures

120 seconds

Malware Config

Targets

- Target
  
  b8572015a663ca716c590a9f4713f7826bcffae45611055494f02e7614cf0fd9N
- Size
  
  2.9MB
- MD5
  
  3b641a7f885496c8b0b1d7fca32476d0
- SHA1
  
  b2dfa97f4d79bdffd748e6c2294d8d32e3a9cecf
- SHA256
  
  b8572015a663ca716c590a9f4713f7826bcffae45611055494f02e7614cf0fd9
- SHA512
  
  311f9091122aaf8d31b31a09380ba33f7fd86cd825437048e855b8ffc779232fb378693d441f5f071f5c77c5b6f504990fcbd3ab1f1f20d83fdf8ddf591e2682
- SSDEEP
  
  24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHS:7v97AXmw4gxeOw46fUbNecCCFbNecf
Score

10^/10

warzonerat discovery evasion infostealer persistence rat
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT payload
  rat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

warzoneratdiscoveryevasioninfostealerpersistencerat

behavioral2

warzoneratdiscoveryevasioninfostealerpersistencerat

© 2018-2025

Terms | Privacy