Overview

overview

10

Static

static

10

ada6ee1735...2N.exe

windows7-x64

10

ada6ee1735...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ada6ee173500985bd12b2912d823477f37237e2482342a8277ccd0b80be72d92N.exe

  • Size

    8.2MB

  • Sample

    241204-kyf3va1jav

  • MD5

    ac7cd4068e50fdffc83e99bd1ee89d10

  • SHA1

    1e2bfdbce4711d4312dbeef387105b1c3f55c5a9

  • SHA256

    ada6ee173500985bd12b2912d823477f37237e2482342a8277ccd0b80be72d92

  • SHA512

    a026eabf7fd57453ef07057a31e6c6221cd022ce604ae2d1f00ed01c89203888fbb657a543a4fbfd576d5bf486443ca1fe41c81051373aaa083ea212793719c3

  • SSDEEP

    49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecA:V8e8e8f8e8e8Z

Score
10/10
warzonerataspackv2discoveryevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      ada6ee173500985bd12b2912d823477f37237e2482342a8277ccd0b80be72d92N.exe

    • Size

      8.2MB

    • MD5

      ac7cd4068e50fdffc83e99bd1ee89d10

    • SHA1

      1e2bfdbce4711d4312dbeef387105b1c3f55c5a9

    • SHA256

      ada6ee173500985bd12b2912d823477f37237e2482342a8277ccd0b80be72d92

    • SHA512

      a026eabf7fd57453ef07057a31e6c6221cd022ce604ae2d1f00ed01c89203888fbb657a543a4fbfd576d5bf486443ca1fe41c81051373aaa083ea212793719c3

    • SSDEEP

      49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecA:V8e8e8f8e8e8Z

    Score
    10/10
    warzonerataspackv2discoveryevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzonerat family

      warzonerat

    • Warzone RAT payload

      rat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks