warzonerat | d62ee9a702da49b7e70b74f5ce1bd7867be37b91b37e3070864f5353ab777452

General

Target

d62ee9a702da49b7e70b74f5ce1bd7867be37b91b37e3070864f5353ab777452
Size

1.2MB
Sample

240818-fx5ycsxelc
MD5

2ae40880991789136f007a161ce8fd98
SHA1

7b117d53eaf0f636d382cf160ac4b0abe6d93ad9
SHA256

d62ee9a702da49b7e70b74f5ce1bd7867be37b91b37e3070864f5353ab777452
SHA512

265633960611be8f2183ea02594004a7af72e0ff0c552d7b0631499327f46b014d645a14f17d61f2bee4213582a0b7df2b11c856e60d63d4ebcba1b31a890042
SSDEEP

24576:ln6qqE5UeCMi3Y1ACV6WHtfRrFCvSBbMA1zxhHBQf2+JjG:VpO1zY1pwWNfO6bMozvHi2+1G

Score

10^/10

Malware Config

Targets

- Target
  
  e9615671d02b16f25444360f643b059cfa117f6ce3097d4fd70e581a668cf56d.exe
- Size
  
  2.0MB
- MD5
  
  eabb6cc837e7978ae6b92c4f14856bd2
- SHA1
  
  b5407903a7b34dd1cfeac9596d6b6137190fefc0
- SHA256
  
  e9615671d02b16f25444360f643b059cfa117f6ce3097d4fd70e581a668cf56d
- SHA512
  
  03dd4d2f3d2a13cc02fd2ee90f0ff0b1ad5e2ff67a02f75807328ce7aba8b91846106e24d6c139796c98cf7245a30c1347786e7229a2bbaa5fc3e62f3265c2c6
- SSDEEP
  
  24576:E4Y7zy/0BmAIElMHz+noppfDCUVhUNiLkwOVy8586SgjxrCHiCG5dtBTH4:YyGJITz/ppfD1mA8DdrCy5XBTY
Score

10^/10

evasion execution trojan warzonerat infostealer rat
- UAC bypass
  evasion trojan
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Windows security bypass
  evasion trojan
- Looks for VirtualBox Guest Additions in registry
  evasion
- Warzone RAT payload
  rat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Uses the VBS compiler for execution
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2