warzonerat | 401d23b2aa6b3d8930763f86b368b4f1d69075be111cd28bcfb7e90be6f57b06 | Triage

Submit
Reports

Overview

overview

Static

static

5bb71ede79...0N.exe

windows7-x64

5bb71ede79...0N.exe

windows10-2004-x64

Sharing

General

Target

5bb71ede79b5a1c96f622e28a2730510N
Size

3.9MB
Sample

240911-aadbyatapb
MD5

5bb71ede79b5a1c96f622e28a2730510
SHA1

5ee4ae896c585a550e4489fa81f3f973d22a1f85
SHA256

401d23b2aa6b3d8930763f86b368b4f1d69075be111cd28bcfb7e90be6f57b06
SHA512

8560ab8c8f9ef1944ce20d9430aa408cfe6f9bf6c798955d41d8226fa281ee35b2d391b0a8024e5e161b6c9dff57f87732260ac2f7ad59dbbd7769c641eca1a5
SSDEEP

24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQD1:7C0bNechC0bNechC0bNect

Score

10^/10

warzonerat aspackv2 discovery evasion infostealer persistence rat

Static task

static1

rat aspackv2 warzonerat

4 signatures

Behavioral task

behavioral1

Sample

5bb71ede79b5a1c96f622e28a2730510N.exe

Resource

win7-20240903-en

warzonerat aspackv2 discovery evasion infostealer persistence rat

windows7-x64

17 signatures

120 seconds

Behavioral task

behavioral2

Sample

5bb71ede79b5a1c96f622e28a2730510N.exe

Resource

win10v2004-20240802-en

warzonerat aspackv2 discovery evasion infostealer persistence rat

windows10-2004-x64

17 signatures

120 seconds

Malware Config

Targets

- Target
  
  5bb71ede79b5a1c96f622e28a2730510N
- Size
  
  3.9MB
- MD5
  
  5bb71ede79b5a1c96f622e28a2730510
- SHA1
  
  5ee4ae896c585a550e4489fa81f3f973d22a1f85
- SHA256
  
  401d23b2aa6b3d8930763f86b368b4f1d69075be111cd28bcfb7e90be6f57b06
- SHA512
  
  8560ab8c8f9ef1944ce20d9430aa408cfe6f9bf6c798955d41d8226fa281ee35b2d391b0a8024e5e161b6c9dff57f87732260ac2f7ad59dbbd7769c641eca1a5
- SSDEEP
  
  24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQD1:7C0bNechC0bNechC0bNect
Score

10^/10

warzonerat aspackv2 discovery evasion infostealer persistence rat
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT payload
  rat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rataspackv2warzonerat

behavioral1

warzonerataspackv2discoveryevasioninfostealerpersistencerat

behavioral2

warzonerataspackv2discoveryevasioninfostealerpersistencerat

© 2018-2025

Terms | Privacy