Overview

overview

10

Static

static

10

dc861ce845...0e.exe

windows7_x64

10

dc861ce845...0e.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc861ce845058409c19525c9928b84742465ce42f5c8ae821f518d582669540e

  • Size

    1.2MB

  • Sample

    210517-khmmll237x

  • MD5

    522470db29dd1fec8b3543980178c9dc

  • SHA1

    b6c47786e6c8484e6b2b5b6848fb6e3554d9dd60

  • SHA256

    dc861ce845058409c19525c9928b84742465ce42f5c8ae821f518d582669540e

  • SHA512

    8aa3b08d0ea1d1bb8ff968359639af808f81dd28d9b5197ef7107c77390e46fd82b9f830132c8d48ee34764b3b2cd95b52e24eb4b26c26cd454b6daa4de3e7b0

Score
10/10
warzonerataspackv2evasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      dc861ce845058409c19525c9928b84742465ce42f5c8ae821f518d582669540e

    • Size

      1.2MB

    • MD5

      522470db29dd1fec8b3543980178c9dc

    • SHA1

      b6c47786e6c8484e6b2b5b6848fb6e3554d9dd60

    • SHA256

      dc861ce845058409c19525c9928b84742465ce42f5c8ae821f518d582669540e

    • SHA512

      8aa3b08d0ea1d1bb8ff968359639af808f81dd28d9b5197ef7107c77390e46fd82b9f830132c8d48ee34764b3b2cd95b52e24eb4b26c26cd454b6daa4de3e7b0

    Score
    10/10
    warzonerataspackv2evasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks