General

  • Target

    c4813b26ebc4c447affb20afcb5fab19_JaffaCakes118

  • Size

    98KB

  • Sample

    241204-1kfg6aylbk

  • MD5

    c4813b26ebc4c447affb20afcb5fab19

  • SHA1

    ecdd702f9843bb20a71aca49bfd2ecee05a017da

  • SHA256

    999a7b81fad8574b7db541047c66142a9a38127369b1372c1a89930572a4123f

  • SHA512

    80b2c8577ffdb148236da5291745cb813b8a34918119393590459a818f822722efdf845de3d9fd26eab3f79beed028e33fcb333534ca296d85eaa9ecb05bc17a

  • SSDEEP

    1536:5Csejmb+6BQyusX1UjtA0uWRf/eloc/9T1jVEyp:AtD6jSm0uWRfCogTjVEG

Malware Config

Extracted

Family

warzonerat

C2

127.0.0.1:5200

Targets

    • Target

      c4813b26ebc4c447affb20afcb5fab19_JaffaCakes118

    • Size

      98KB

    • MD5

      c4813b26ebc4c447affb20afcb5fab19

    • SHA1

      ecdd702f9843bb20a71aca49bfd2ecee05a017da

    • SHA256

      999a7b81fad8574b7db541047c66142a9a38127369b1372c1a89930572a4123f

    • SHA512

      80b2c8577ffdb148236da5291745cb813b8a34918119393590459a818f822722efdf845de3d9fd26eab3f79beed028e33fcb333534ca296d85eaa9ecb05bc17a

    • SSDEEP

      1536:5Csejmb+6BQyusX1UjtA0uWRf/eloc/9T1jVEyp:AtD6jSm0uWRfCogTjVEG

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzonerat family

    • Warzone RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks