warzonerat | f914ad33558dee03a8ad15a0f4c36fb6bbfb8d4d3dda8ebff6831d6b99dbd318 | Triage

Submit
Reports

Overview

overview

Static

static

f914ad3355...8N.exe

windows7-x64

f914ad3355...8N.exe

windows10-2004-x64

Sharing

General

Target

f914ad33558dee03a8ad15a0f4c36fb6bbfb8d4d3dda8ebff6831d6b99dbd318N
Size

8.9MB
Sample

241106-cb79tatcjn
MD5

db9493eddb9ad914244be4dc6f8a1190
SHA1

5c3cc40ec64f76ef044a99945a7543877e6f1ea0
SHA256

f914ad33558dee03a8ad15a0f4c36fb6bbfb8d4d3dda8ebff6831d6b99dbd318
SHA512

a34aa1302f59d733fd94cc76e26eb5af886ea0c61f57cc8aa38f224642a3d1eb28c99f10b2e4bcb489c0fe0a3a4c8800ee62e559501a23633bf54af57d09f615
SSDEEP

49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecA:K1+8e8e8f8e8e8n

Score

10^/10

warzonerat discovery evasion infostealer persistence rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

f914ad33558dee03a8ad15a0f4c36fb6bbfb8d4d3dda8ebff6831d6b99dbd318N.exe

Resource

win7-20241023-en

warzonerat discovery evasion infostealer persistence rat

windows7-x64

17 signatures

120 seconds

Behavioral task

behavioral2

Sample

f914ad33558dee03a8ad15a0f4c36fb6bbfb8d4d3dda8ebff6831d6b99dbd318N.exe

Resource

win10v2004-20241007-en

warzonerat discovery evasion infostealer persistence rat

windows10-2004-x64

16 signatures

120 seconds

Malware Config

Targets

- Target
  
  f914ad33558dee03a8ad15a0f4c36fb6bbfb8d4d3dda8ebff6831d6b99dbd318N
- Size
  
  8.9MB
- MD5
  
  db9493eddb9ad914244be4dc6f8a1190
- SHA1
  
  5c3cc40ec64f76ef044a99945a7543877e6f1ea0
- SHA256
  
  f914ad33558dee03a8ad15a0f4c36fb6bbfb8d4d3dda8ebff6831d6b99dbd318
- SHA512
  
  a34aa1302f59d733fd94cc76e26eb5af886ea0c61f57cc8aa38f224642a3d1eb28c99f10b2e4bcb489c0fe0a3a4c8800ee62e559501a23633bf54af57d09f615
- SSDEEP
  
  49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecA:K1+8e8e8f8e8e8n
Score

10^/10

warzonerat discovery evasion infostealer persistence rat
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzonerat family
  warzonerat
- Warzone RAT payload
  rat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

warzoneratdiscoveryevasioninfostealerpersistencerat

behavioral2

warzoneratdiscoveryevasioninfostealerpersistencerat

© 2018-2025

Terms | Privacy