Overview

overview

10

Static

static

10

4b2a6f204d...85.exe

windows7_x64

10

4b2a6f204d...85.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b2a6f204d228b19015951b7cc6647f0f1eec36f8ff15e534e7ec170981e9d85

  • Size

    1.2MB

  • Sample

    210518-ke2etwnpdn

  • MD5

    11926aa36fab1d20d7087ac5b12c477c

  • SHA1

    640f1e7539b0ea2d7ca0feac961bfdf5d06bc16f

  • SHA256

    4b2a6f204d228b19015951b7cc6647f0f1eec36f8ff15e534e7ec170981e9d85

  • SHA512

    ca0c544c1b0298e8541beddbbe730cd9dc45aaf4a81c8d9b885fedfedf493633a98eac62dbb5601d9f08de715d9c079ea1a96b5ff4d03ea98dba0a33432090c9

Score
10/10
warzoneratxmrigaspackv2evasioninfostealerminerpersistencerat

Malware Config

Targets

    • Target

      4b2a6f204d228b19015951b7cc6647f0f1eec36f8ff15e534e7ec170981e9d85

    • Size

      1.2MB

    • MD5

      11926aa36fab1d20d7087ac5b12c477c

    • SHA1

      640f1e7539b0ea2d7ca0feac961bfdf5d06bc16f

    • SHA256

      4b2a6f204d228b19015951b7cc6647f0f1eec36f8ff15e534e7ec170981e9d85

    • SHA512

      ca0c544c1b0298e8541beddbbe730cd9dc45aaf4a81c8d9b885fedfedf493633a98eac62dbb5601d9f08de715d9c079ea1a96b5ff4d03ea98dba0a33432090c9

    Score
    10/10
    warzoneratxmrigaspackv2evasioninfostealerminerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Warzone RAT Payload

      rat

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks