General

  • Target

    2630fde07457a0e40cedaa483faaded7535a64d27bbb9a9c3a2bbd0ecd0080d5

  • Size

    8.2MB

  • Sample

    241106-znakmsyanm

  • MD5

    a7ba7090ad071f609bc8318b45ed80fd

  • SHA1

    336fb48b1d62c1f6b91f57ddd7f6245dfe898281

  • SHA256

    2630fde07457a0e40cedaa483faaded7535a64d27bbb9a9c3a2bbd0ecd0080d5

  • SHA512

    e7744a02f01e67662ccbdfe4f3f841e89ac29dea5870e7c25d37f9f67275dc4a603d2b6a5fbda4c6262395e5d16aa2282080d8debe199bed1c6e1c567cc1a7cc

  • SSDEEP

    49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecU:V8e8e8f8e8e8J

Malware Config

Targets

    • Target

      2630fde07457a0e40cedaa483faaded7535a64d27bbb9a9c3a2bbd0ecd0080d5

    • Size

      8.2MB

    • MD5

      a7ba7090ad071f609bc8318b45ed80fd

    • SHA1

      336fb48b1d62c1f6b91f57ddd7f6245dfe898281

    • SHA256

      2630fde07457a0e40cedaa483faaded7535a64d27bbb9a9c3a2bbd0ecd0080d5

    • SHA512

      e7744a02f01e67662ccbdfe4f3f841e89ac29dea5870e7c25d37f9f67275dc4a603d2b6a5fbda4c6262395e5d16aa2282080d8debe199bed1c6e1c567cc1a7cc

    • SSDEEP

      49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecU:V8e8e8f8e8e8J

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzonerat family

    • Warzone RAT payload

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks