General
-
Target
f00ab5404cb2861855a24c90fa391c7e4b4e9f22839b69f8994111313bf7cf6e
-
Size
1.2MB
-
Sample
240429-ebk6dshb73
-
MD5
00317ea3b188e0e7f7e10958ede210f4
-
SHA1
3a8a40799b9424574f56864c06a6cd67afa9902e
-
SHA256
f00ab5404cb2861855a24c90fa391c7e4b4e9f22839b69f8994111313bf7cf6e
-
SHA512
5aec4fc5ebbd9ff93ef8560a9ea5570d5e4c9004ac3f80b06133e5a6c3da824a7215bc48f5e0d75d205ac1b0af31df4ba3139d458f07018d91645ac0f73e5a2b
-
SSDEEP
12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11ks:OIbGD2JTu0GoZQDbGV6eH81ks
Behavioral task
behavioral1
Sample
f00ab5404cb2861855a24c90fa391c7e4b4e9f22839b69f8994111313bf7cf6e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f00ab5404cb2861855a24c90fa391c7e4b4e9f22839b69f8994111313bf7cf6e.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
f00ab5404cb2861855a24c90fa391c7e4b4e9f22839b69f8994111313bf7cf6e
-
Size
1.2MB
-
MD5
00317ea3b188e0e7f7e10958ede210f4
-
SHA1
3a8a40799b9424574f56864c06a6cd67afa9902e
-
SHA256
f00ab5404cb2861855a24c90fa391c7e4b4e9f22839b69f8994111313bf7cf6e
-
SHA512
5aec4fc5ebbd9ff93ef8560a9ea5570d5e4c9004ac3f80b06133e5a6c3da824a7215bc48f5e0d75d205ac1b0af31df4ba3139d458f07018d91645ac0f73e5a2b
-
SSDEEP
12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11ks:OIbGD2JTu0GoZQDbGV6eH81ks
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Detects executables packed with ASPack
-
Warzone RAT payload
-
Modifies Installed Components in the registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1