warzonerat | 78df1676000a461cdda4e1493b26619e3a934d183fee71987a2175c590cf69b4

General

Target

78df1676000a461cdda4e1493b26619e3a934d183fee7.exe
Size

305KB
Sample

221101-s1ydxadhhn
MD5

5e6e80de8f7d0e5da3656ef938d5d986
SHA1

69de6a0d7861592604f9495b5e0a7c2e7d4c0021
SHA256

78df1676000a461cdda4e1493b26619e3a934d183fee71987a2175c590cf69b4
SHA512

79f80953b5f68baef34851f9e3100021764a646daec3336700f6ebda429a17f49d254e159814a4dbeafc3f5c01ae9599b7b49a2b2bf0714b45c97c6c6ad98922
SSDEEP

6144:3wq3Nphr3dZZ6ZmiYOS0dNgbDIr1kruxJ+3WTHNP34JX5/y:3zNjfZWy9wK4x6CNP34v/y

Score

10^/10

Malware Config

Targets

- Target
  
  78df1676000a461cdda4e1493b26619e3a934d183fee7.exe
- Size
  
  305KB
- MD5
  
  5e6e80de8f7d0e5da3656ef938d5d986
- SHA1
  
  69de6a0d7861592604f9495b5e0a7c2e7d4c0021
- SHA256
  
  78df1676000a461cdda4e1493b26619e3a934d183fee71987a2175c590cf69b4
- SHA512
  
  79f80953b5f68baef34851f9e3100021764a646daec3336700f6ebda429a17f49d254e159814a4dbeafc3f5c01ae9599b7b49a2b2bf0714b45c97c6c6ad98922
- SSDEEP
  
  6144:3wq3Nphr3dZZ6ZmiYOS0dNgbDIr1kruxJ+3WTHNP34JX5/y:3zNjfZWy9wK4x6CNP34v/y
Score

10^/10

warzonerat discovery evasion infostealer persistence rat upx
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets DLL path for service in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2