General

  • Target

    f00ab5404cb2861855a24c90fa391c7e4b4e9f22839b69f8994111313bf7cf6e

  • Size

    1.2MB

  • Sample

    240429-ebk6dshb73

  • MD5

    00317ea3b188e0e7f7e10958ede210f4

  • SHA1

    3a8a40799b9424574f56864c06a6cd67afa9902e

  • SHA256

    f00ab5404cb2861855a24c90fa391c7e4b4e9f22839b69f8994111313bf7cf6e

  • SHA512

    5aec4fc5ebbd9ff93ef8560a9ea5570d5e4c9004ac3f80b06133e5a6c3da824a7215bc48f5e0d75d205ac1b0af31df4ba3139d458f07018d91645ac0f73e5a2b

  • SSDEEP

    12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11ks:OIbGD2JTu0GoZQDbGV6eH81ks

Malware Config

Targets

    • Target

      f00ab5404cb2861855a24c90fa391c7e4b4e9f22839b69f8994111313bf7cf6e

    • Size

      1.2MB

    • MD5

      00317ea3b188e0e7f7e10958ede210f4

    • SHA1

      3a8a40799b9424574f56864c06a6cd67afa9902e

    • SHA256

      f00ab5404cb2861855a24c90fa391c7e4b4e9f22839b69f8994111313bf7cf6e

    • SHA512

      5aec4fc5ebbd9ff93ef8560a9ea5570d5e4c9004ac3f80b06133e5a6c3da824a7215bc48f5e0d75d205ac1b0af31df4ba3139d458f07018d91645ac0f73e5a2b

    • SSDEEP

      12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11ks:OIbGD2JTu0GoZQDbGV6eH81ks

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Detects executables packed with ASPack

    • Warzone RAT payload

    • Modifies Installed Components in the registry

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks