General
- Target 4489fe80c29aec286a80004ab817aef0.exe
- Size 358KB
- Sample201028-e2p8xely52
- SHA256 9bbe3fd9a991edfa2f20c9afeb7f6eeb8ac34adfde9d6a5320aed218b1785281
Score
10/10
Malware Config
Targets
-
- Target 4489fe80c29aec286a80004ab817aef0.exe
- Size 358KB
- SHA256 9bbe3fd9a991edfa2f20c9afeb7f6eeb8ac34adfde9d6a5320aed218b1785281
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
ServiceHost packer
Detects ServiceHost packer used for .NET malware
-
Warzone RAT Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
JavaScript code in executable
-
Suspicious use of SetThreadContext