Overview

overview

10

Static

static

10

681aa8558d...71.exe

windows7_x64

10

681aa8558d...71.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    681aa8558dca5f10c217f1a827f13305037803a454d83f2a4bdf69c06ab45271

  • Size

    1.2MB

  • Sample

    210517-8qsxyg2r9x

  • MD5

    8ff7ca1f9a9c31cba4a66e9b22328244

  • SHA1

    5778d4fb2e2bb35fd6d30c3fbbb2f9573345dd6f

  • SHA256

    681aa8558dca5f10c217f1a827f13305037803a454d83f2a4bdf69c06ab45271

  • SHA512

    38caf5038227929e4bb6681815c084a807863cc3511982c259473ec237e77d847ce41110f9b4ec3a57e24c453906bbe942282a12c8132f1913b01605c71e8fa3

Score
10/10
warzonerataspackv2evasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      681aa8558dca5f10c217f1a827f13305037803a454d83f2a4bdf69c06ab45271

    • Size

      1.2MB

    • MD5

      8ff7ca1f9a9c31cba4a66e9b22328244

    • SHA1

      5778d4fb2e2bb35fd6d30c3fbbb2f9573345dd6f

    • SHA256

      681aa8558dca5f10c217f1a827f13305037803a454d83f2a4bdf69c06ab45271

    • SHA512

      38caf5038227929e4bb6681815c084a807863cc3511982c259473ec237e77d847ce41110f9b4ec3a57e24c453906bbe942282a12c8132f1913b01605c71e8fa3

    Score
    10/10
    warzonerataspackv2evasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks