Overview

overview

10

Static

static

10

daefeafa9a...cN.exe

windows7-x64

10

daefeafa9a...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    daefeafa9a0a74f28179184311ceb9ba82db8ca4839ac1148f63d669f394a64cN.exe

  • Size

    8.9MB

  • Sample

    241218-fl23bstpgx

  • MD5

    b1d4899b07ebb4c424baf4c480df5b10

  • SHA1

    c97c5b60f8ac2105b936809c95abf9fae1942b9c

  • SHA256

    daefeafa9a0a74f28179184311ceb9ba82db8ca4839ac1148f63d669f394a64c

  • SHA512

    ee65eb319eba4b13c361be2708e836d0243eb4da79b93649200e34e17e8e30714c92ed4e9b3270ef8389d82b1990aec51536dd830eb081bc00b2aba20bee4ebc

  • SSDEEP

    49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNect:K1+8e8e8f8e8e8+

Score
10/10
warzoneratdiscoveryevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      daefeafa9a0a74f28179184311ceb9ba82db8ca4839ac1148f63d669f394a64cN.exe

    • Size

      8.9MB

    • MD5

      b1d4899b07ebb4c424baf4c480df5b10

    • SHA1

      c97c5b60f8ac2105b936809c95abf9fae1942b9c

    • SHA256

      daefeafa9a0a74f28179184311ceb9ba82db8ca4839ac1148f63d669f394a64c

    • SHA512

      ee65eb319eba4b13c361be2708e836d0243eb4da79b93649200e34e17e8e30714c92ed4e9b3270ef8389d82b1990aec51536dd830eb081bc00b2aba20bee4ebc

    • SSDEEP

      49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNect:K1+8e8e8f8e8e8+

    Score
    10/10
    warzoneratdiscoveryevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzonerat family

      warzonerat

    • Warzone RAT payload

      rat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks