General
-
Target
db1bedf0288baa1f3a680ebc611780cd9cf939937e53ceaba0aef29f6730a887N.exe
-
Size
8.2MB
-
Sample
241201-wde6laskap
-
MD5
93943cb09d93aa04e31de91e9c00ba00
-
SHA1
17a641205716ec84c83425cd30e351d2a5a8ea86
-
SHA256
db1bedf0288baa1f3a680ebc611780cd9cf939937e53ceaba0aef29f6730a887
-
SHA512
d963f6d5be2221ac211f40c60515a9635d0d55f127c13d883359aa220a161d60c66dd3f449d1fea6f7f1fbdb05143fb3e36035745368a62012f33de944421e28
-
SSDEEP
49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecR:V8e8e8f8e8e8M
Malware Config
Targets
-
-
Target
db1bedf0288baa1f3a680ebc611780cd9cf939937e53ceaba0aef29f6730a887N.exe
-
Size
8.2MB
-
MD5
93943cb09d93aa04e31de91e9c00ba00
-
SHA1
17a641205716ec84c83425cd30e351d2a5a8ea86
-
SHA256
db1bedf0288baa1f3a680ebc611780cd9cf939937e53ceaba0aef29f6730a887
-
SHA512
d963f6d5be2221ac211f40c60515a9635d0d55f127c13d883359aa220a161d60c66dd3f449d1fea6f7f1fbdb05143fb3e36035745368a62012f33de944421e28
-
SSDEEP
49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecR:V8e8e8f8e8e8M
Score10/10-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4