General
-
Target
5cad75fa91592877ce563ac72aaa5bfcba1ffe0b4dc80e758bcabe3d3af0f266
-
Size
3.9MB
-
Sample
240816-3de9xsxckm
-
MD5
b92c65b8d588a3c04f2c9c80bd026f39
-
SHA1
fbb7b69139ccdc25f8948fc633e05cfb59715a3d
-
SHA256
5cad75fa91592877ce563ac72aaa5bfcba1ffe0b4dc80e758bcabe3d3af0f266
-
SHA512
014e14f7b88c4401d7fa040dab6cd4380b8d4d4c895f5941d8231d80a301f6ae78dc89e6961b54c4b1fd78d818c5a7f3fc3795ca9504959bcfd3a6046edfcb1a
-
SSDEEP
24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDG:7C0bNechC0bNechC0bNecu
Malware Config
Targets
-
-
Target
5cad75fa91592877ce563ac72aaa5bfcba1ffe0b4dc80e758bcabe3d3af0f266
-
Size
3.9MB
-
MD5
b92c65b8d588a3c04f2c9c80bd026f39
-
SHA1
fbb7b69139ccdc25f8948fc633e05cfb59715a3d
-
SHA256
5cad75fa91592877ce563ac72aaa5bfcba1ffe0b4dc80e758bcabe3d3af0f266
-
SHA512
014e14f7b88c4401d7fa040dab6cd4380b8d4d4c895f5941d8231d80a301f6ae78dc89e6961b54c4b1fd78d818c5a7f3fc3795ca9504959bcfd3a6046edfcb1a
-
SSDEEP
24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDG:7C0bNechC0bNechC0bNecu
Score10/10-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4