Overview

overview

10

Static

static

10

88e97109a5...AS.exe

windows7-x64

10

88e97109a5...AS.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88e97109a52c36e2cf54ee8c708f6c30_NEAS

  • Size

    1.8MB

  • Sample

    240507-hp9bxsdf9w

  • MD5

    88e97109a52c36e2cf54ee8c708f6c30

  • SHA1

    9ff67a9a7116db62561b283d481bf85bb5c099bb

  • SHA256

    5104bb8f72ee0eeedbf6c5cb847cd705708361f9f24d77a4c84716dcb2bd7179

  • SHA512

    33539b5bc7079432ec4eb2008f588838a4bb845dc4857c95f9faf40d9acd1866fbfb294b689292b875fd68285ede4b8ed9ef1aa7b7b22da897d9b33ea4e0ac78

  • SSDEEP

    12288:t99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDgM:X1gg4CppEI6GGfWDkCQDbGV6eH81k/

Score
10/10
warzoneratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      88e97109a52c36e2cf54ee8c708f6c30_NEAS

    • Size

      1.8MB

    • MD5

      88e97109a52c36e2cf54ee8c708f6c30

    • SHA1

      9ff67a9a7116db62561b283d481bf85bb5c099bb

    • SHA256

      5104bb8f72ee0eeedbf6c5cb847cd705708361f9f24d77a4c84716dcb2bd7179

    • SHA512

      33539b5bc7079432ec4eb2008f588838a4bb845dc4857c95f9faf40d9acd1866fbfb294b689292b875fd68285ede4b8ed9ef1aa7b7b22da897d9b33ea4e0ac78

    • SSDEEP

      12288:t99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDgM:X1gg4CppEI6GGfWDkCQDbGV6eH81k/

    Score
    10/10
    warzoneratevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks