Overview

overview

10

Static

static

10

03d5d44867...2N.exe

windows7-x64

10

03d5d44867...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03d5d448679bca47135c8426a5a9b7b9251de19542301da485fa559754d38f32N.exe

  • Size

    8.2MB

  • Sample

    241125-t32psasldn

  • MD5

    b68998e3871efbc5498d951c844d51c0

  • SHA1

    504230e66ef83d043d3871b77afb0c56baa62c04

  • SHA256

    03d5d448679bca47135c8426a5a9b7b9251de19542301da485fa559754d38f32

  • SHA512

    0601181fafba10ac16ef0d93c6178159d6639c338c2474845fffbe156403f7cb7609e57e9e6d36ee317b36884306fd1c1e5f3d4b6cf5e0965f4ac43a01ff7884

  • SSDEEP

    49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNec8:V8e8e8f8e8e8X

Score
10/10
warzonerataspackv2discoveryevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      03d5d448679bca47135c8426a5a9b7b9251de19542301da485fa559754d38f32N.exe

    • Size

      8.2MB

    • MD5

      b68998e3871efbc5498d951c844d51c0

    • SHA1

      504230e66ef83d043d3871b77afb0c56baa62c04

    • SHA256

      03d5d448679bca47135c8426a5a9b7b9251de19542301da485fa559754d38f32

    • SHA512

      0601181fafba10ac16ef0d93c6178159d6639c338c2474845fffbe156403f7cb7609e57e9e6d36ee317b36884306fd1c1e5f3d4b6cf5e0965f4ac43a01ff7884

    • SSDEEP

      49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNec8:V8e8e8f8e8e8X

    Score
    10/10
    warzonerataspackv2discoveryevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzonerat family

      warzonerat

    • Warzone RAT payload

      rat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks