General
-
Target
1c820fcba0278fc3b44eddd77706776243e7fd0ad4e49d5291dda6aac57f8c98N.exe
-
Size
8.2MB
-
Sample
241122-24z7caxpaj
-
MD5
4e62a4274a0ec4cb04a71161ce7ce2f0
-
SHA1
d9565c52ae41f7288ae995cf236cf7c83c0c61ff
-
SHA256
1c820fcba0278fc3b44eddd77706776243e7fd0ad4e49d5291dda6aac57f8c98
-
SHA512
ac46c2aa574c2fca975bf076afe8d77e1d580b075711d79052bf58e30a9cbb2c2b79ad0c3b5e339dd4dfddb904c70f4f7e6aaf0599f347d726e54ff1f76dce53
-
SSDEEP
49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecT:V8e8e8f8e8e8I
Malware Config
Targets
-
-
Target
1c820fcba0278fc3b44eddd77706776243e7fd0ad4e49d5291dda6aac57f8c98N.exe
-
Size
8.2MB
-
MD5
4e62a4274a0ec4cb04a71161ce7ce2f0
-
SHA1
d9565c52ae41f7288ae995cf236cf7c83c0c61ff
-
SHA256
1c820fcba0278fc3b44eddd77706776243e7fd0ad4e49d5291dda6aac57f8c98
-
SHA512
ac46c2aa574c2fca975bf076afe8d77e1d580b075711d79052bf58e30a9cbb2c2b79ad0c3b5e339dd4dfddb904c70f4f7e6aaf0599f347d726e54ff1f76dce53
-
SSDEEP
49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecT:V8e8e8f8e8e8I
Score10/10-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4