General
-
Target
58fca06eb007b307f845e0865123155055ed995f2a8199ff377dc337356ddbcf
-
Size
2.9MB
-
Sample
240430-19qdnahc4s
-
MD5
3be3c4e2ecc28f66fdc41987f61381eb
-
SHA1
19759daa9fcda3402a7cd2d31f9c68c1b2a56688
-
SHA256
58fca06eb007b307f845e0865123155055ed995f2a8199ff377dc337356ddbcf
-
SHA512
8ce638b69726d63fd74b6c6e3b972b4737b97260283277018cc26be4049ebd0274b3574d3a48fafd8a6c9143f14401a0a754b09fb5fe7a146857db38dfc86cda
-
SSDEEP
24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHZ:7v97AXmw4gxeOw46fUbNecCCFbNecA
Behavioral task
behavioral1
Sample
58fca06eb007b307f845e0865123155055ed995f2a8199ff377dc337356ddbcf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
58fca06eb007b307f845e0865123155055ed995f2a8199ff377dc337356ddbcf.exe
Resource
win10v2004-20240419-en
Malware Config
Targets
-
-
Target
58fca06eb007b307f845e0865123155055ed995f2a8199ff377dc337356ddbcf
-
Size
2.9MB
-
MD5
3be3c4e2ecc28f66fdc41987f61381eb
-
SHA1
19759daa9fcda3402a7cd2d31f9c68c1b2a56688
-
SHA256
58fca06eb007b307f845e0865123155055ed995f2a8199ff377dc337356ddbcf
-
SHA512
8ce638b69726d63fd74b6c6e3b972b4737b97260283277018cc26be4049ebd0274b3574d3a48fafd8a6c9143f14401a0a754b09fb5fe7a146857db38dfc86cda
-
SSDEEP
24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHZ:7v97AXmw4gxeOw46fUbNecCCFbNecA
Score10/10-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Detects executables packed with ASPack
-
Warzone RAT payload
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4