warzonerat | 1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

1f6feae633...b5.exe

windows7-x64

1f6feae633...b5.exe

windows10-2004-x64

Sharing

General

Target

1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5
Size

275KB
Sample

241210-tpzm9szmat
MD5

21aea7934aee995629e68e5834695608
SHA1

94e690f33e0f7b8ea8a1c665359836b363cc09a5
SHA256

1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5
SHA512

b25883eecaa34a355047c4c6c0f684298f2803e757ffb3fdc6b097c62283e96b6801cafa3eaab9eb49df79c2abefebcc5d53816b877bd9ce108864785942b0ad
SSDEEP

6144:1b0neHPqlbJjsye59MQwtBakPHyxqZ3I6qGtVmIt2M3FraeLh87knbqbNyd:2neSbJOD5WXuqZ3IxGtPtBZae1M+mM

Score

10^/10

warzonerat discovery infostealer persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5.exe

Resource

win7-20240903-en

warzonerat discovery infostealer persistence rat

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5.exe

Resource

win10v2004-20241007-en

warzonerat discovery infostealer persistence rat

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

warzonerat

C2

dns.stipamana.com:5219

Targets

- Target
  
  1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5
- Size
  
  275KB
- MD5
  
  21aea7934aee995629e68e5834695608
- SHA1
  
  94e690f33e0f7b8ea8a1c665359836b363cc09a5
- SHA256
  
  1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5
- SHA512
  
  b25883eecaa34a355047c4c6c0f684298f2803e757ffb3fdc6b097c62283e96b6801cafa3eaab9eb49df79c2abefebcc5d53816b877bd9ce108864785942b0ad
- SSDEEP
  
  6144:1b0neHPqlbJjsye59MQwtBakPHyxqZ3I6qGtVmIt2M3FraeLh87knbqbNyd:2neSbJOD5WXuqZ3IxGtPtBZae1M+mM
Score

10^/10

warzonerat discovery infostealer persistence rat
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzonerat family
  warzonerat
- Warzone RAT payload
  rat
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

warzoneratdiscoveryinfostealerpersistencerat

behavioral2

warzoneratdiscoveryinfostealerpersistencerat

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.