Overview

overview

10

Static

static

10

09a3785bbf...71.exe

windows7_x64

10

09a3785bbf...71.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09a3785bbf93c22d0a4a24bf19c478ac73f86e2e1ae37af3b28c8f174ff58a71

  • Size

    1.8MB

  • Sample

    210516-e88c6g4qrn

  • MD5

    4fa39d7084dac93fc279d3811d11d62f

  • SHA1

    d7131759b830a3bf94afe9c8e37550a08d1e22d4

  • SHA256

    09a3785bbf93c22d0a4a24bf19c478ac73f86e2e1ae37af3b28c8f174ff58a71

  • SHA512

    f1a6e51c6bfd51b6c9a1cfac3312a658a0f8b7a0434a3fda61a0e2fff0f0512f1f24f26ddb0c6fa51189dc8f2e0e96cfefe2551f2471a87d677b699b78ab57b6

Score
10/10
warzoneratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      09a3785bbf93c22d0a4a24bf19c478ac73f86e2e1ae37af3b28c8f174ff58a71

    • Size

      1.8MB

    • MD5

      4fa39d7084dac93fc279d3811d11d62f

    • SHA1

      d7131759b830a3bf94afe9c8e37550a08d1e22d4

    • SHA256

      09a3785bbf93c22d0a4a24bf19c478ac73f86e2e1ae37af3b28c8f174ff58a71

    • SHA512

      f1a6e51c6bfd51b6c9a1cfac3312a658a0f8b7a0434a3fda61a0e2fff0f0512f1f24f26ddb0c6fa51189dc8f2e0e96cfefe2551f2471a87d677b699b78ab57b6

    Score
    10/10
    warzoneratevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks