General
-
Target
OneDrive.txt.exe
-
Size
492KB
-
Sample
221103-q2w65aahg5
-
MD5
c94e0e97ee25adcc096039614fdc8ad4
-
SHA1
d17638d974cce11736a4f54b484ca64434bc0b28
-
SHA256
27bb525d1ff560e9c7030c82be005eca2472cf91e9271efaec1ce8428d4f0f42
-
SHA512
7f4a6559c6180a0a2f4e42bd538ec78a40eeb9dc0d3fc827fbed2f56367349ce6a2f42a903557d59cd8318a61d54d225358aafacfe279275a8d4fcbd059cafd0
-
SSDEEP
12288:ozaLE6XPB68kP+FMXaoyvwomtCZ9cpgXW+A4GSr3T+Qjk:rR5WHalmtgC+Br1k
Malware Config
Targets
-
-
Target
OneDrive.txt.exe
-
Size
492KB
-
MD5
c94e0e97ee25adcc096039614fdc8ad4
-
SHA1
d17638d974cce11736a4f54b484ca64434bc0b28
-
SHA256
27bb525d1ff560e9c7030c82be005eca2472cf91e9271efaec1ce8428d4f0f42
-
SHA512
7f4a6559c6180a0a2f4e42bd538ec78a40eeb9dc0d3fc827fbed2f56367349ce6a2f42a903557d59cd8318a61d54d225358aafacfe279275a8d4fcbd059cafd0
-
SSDEEP
12288:ozaLE6XPB68kP+FMXaoyvwomtCZ9cpgXW+A4GSr3T+Qjk:rR5WHalmtgC+Br1k
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets DLL path for service in the registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-