General
-
Target
bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1
-
Size
3.9MB
-
Sample
240524-c3346sac2w
-
MD5
7ed5f6a2ae0fa8be8cd3124d379f74b6
-
SHA1
88bb76794db51f54f0e8ea271bba9a73f71f6d0a
-
SHA256
bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1
-
SHA512
812d9595b6e09b15ed635296ccb408f7cc37a90944bc3474af1c216ee765813dfa9b25fcf29d970ad33563104196a2d5d1f4984b57d546614536e3fa00de8b47
-
SSDEEP
24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDR:7C0bNechC0bNechC0bNecZ
Behavioral task
behavioral1
Sample
bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1
-
Size
3.9MB
-
MD5
7ed5f6a2ae0fa8be8cd3124d379f74b6
-
SHA1
88bb76794db51f54f0e8ea271bba9a73f71f6d0a
-
SHA256
bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1
-
SHA512
812d9595b6e09b15ed635296ccb408f7cc37a90944bc3474af1c216ee765813dfa9b25fcf29d970ad33563104196a2d5d1f4984b57d546614536e3fa00de8b47
-
SSDEEP
24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDR:7C0bNechC0bNechC0bNecZ
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Modifies Installed Components in the registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1