General
-
Target
Taxinvoice1198691264·pdf.exe
-
Size
558KB
-
Sample
230208-jps6dahf68
-
MD5
d64248de7641b1efd1137fcb3d5b5023
-
SHA1
841e007277d085f43afecba308ad7e0edee81dcc
-
SHA256
ef56f8c0615d059de3d0f669b651d38caf535155878ff4bc7d1b1a62abd45213
-
SHA512
38bbbc75a903978492ed91aedc6141a935a38d9573ad55a7916e224e92d396259b988a2de3aaed90407140f213eac5e553ea18826005c97e19284286f0dff36b
-
SSDEEP
12288:Iky+IuY0vH9+/dUj4fn7fJkB+N8v2ocCSivrlicgUKiW2Y:Q9uY6H4K4fSS8vcKGkY
Static task
static1
Behavioral task
behavioral1
Sample
Taxinvoice1198691264·pdf.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Taxinvoice1198691264·pdf.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
Taxinvoice1198691264·pdf.exe
-
Size
558KB
-
MD5
d64248de7641b1efd1137fcb3d5b5023
-
SHA1
841e007277d085f43afecba308ad7e0edee81dcc
-
SHA256
ef56f8c0615d059de3d0f669b651d38caf535155878ff4bc7d1b1a62abd45213
-
SHA512
38bbbc75a903978492ed91aedc6141a935a38d9573ad55a7916e224e92d396259b988a2de3aaed90407140f213eac5e553ea18826005c97e19284286f0dff36b
-
SSDEEP
12288:Iky+IuY0vH9+/dUj4fn7fJkB+N8v2ocCSivrlicgUKiW2Y:Q9uY6H4K4fSS8vcKGkY
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Modifies Windows Firewall
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Modifies WinLogon
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-