Overview

overview

10

Static

static

10

b96cadea25...29.exe

windows7-x64

10

b96cadea25...29.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b96cadea25700746e660755db993cf2c03031e5461ff78905d84a1e6d5391729.exe

  • Size

    8.2MB

  • Sample

    241203-ebxjestrhj

  • MD5

    5515f6ca46c781d94fe9444de86903d2

  • SHA1

    212e6fd5aff18a3a8379f3579c8504234ae4f675

  • SHA256

    b96cadea25700746e660755db993cf2c03031e5461ff78905d84a1e6d5391729

  • SHA512

    c2730ad57c24d7b88daa88a7a28126aa92fefd18def8709733c59935202f9e606493be616b9ec407cc768a83ea49016530b0b5f52021d0c001611f8e68475c8c

  • SSDEEP

    49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecg:V8e8e8f8e8e8x

Score
10/10
warzonerataspackv2discoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      b96cadea25700746e660755db993cf2c03031e5461ff78905d84a1e6d5391729.exe

    • Size

      8.2MB

    • MD5

      5515f6ca46c781d94fe9444de86903d2

    • SHA1

      212e6fd5aff18a3a8379f3579c8504234ae4f675

    • SHA256

      b96cadea25700746e660755db993cf2c03031e5461ff78905d84a1e6d5391729

    • SHA512

      c2730ad57c24d7b88daa88a7a28126aa92fefd18def8709733c59935202f9e606493be616b9ec407cc768a83ea49016530b0b5f52021d0c001611f8e68475c8c

    • SSDEEP

      49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecg:V8e8e8f8e8e8x

    Score
    10/10
    warzoneratdiscoveryinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzonerat family

      warzonerat

    • Warzone RAT payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks