Resubmissions

25-09-2024 12:52

240925-p343paweln 6

24-09-2024 15:56

240924-tdvj6ssall 6

24-09-2024 15:33

240924-szaapavbmg 10

General

  • Target

    https://github.com/HalilDeniz/RansomwareSim

  • Sample

    240924-szaapavbmg

Malware Config

Extracted

Family

warzonerat

C2

168.61.222.215:5400

Targets

    • Target

      https://github.com/HalilDeniz/RansomwareSim

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

    • Warzone RAT payload

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks