Overview

overview

10

Static

static

10

021dd782c1...6N.exe

windows7-x64

10

021dd782c1...6N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    021dd782c1aa99d4a6bd4fd57a843a2fdc7b63820ae41e6157b9baaf7ac3fa36N.exe

  • Size

    8.2MB

  • Sample

    241222-qqkc7azlhw

  • MD5

    bbad0d0174334cf90ed6d1ba88fbbcd0

  • SHA1

    6c3bc5b3ffd9cbc77a8b253971211a6e68053287

  • SHA256

    021dd782c1aa99d4a6bd4fd57a843a2fdc7b63820ae41e6157b9baaf7ac3fa36

  • SHA512

    d4b923b672f4a4aea10b343a3d42fa33f6a44d3cd850e452a7d78bed716c9ae059c816797845ca0393abf08ca7681c55a664d727088b36832f7907c1a24b08ce

  • SSDEEP

    49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNec1:V8e8e8f8e8e8+

Score
10/10
warzonerataspackv2discoveryevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      021dd782c1aa99d4a6bd4fd57a843a2fdc7b63820ae41e6157b9baaf7ac3fa36N.exe

    • Size

      8.2MB

    • MD5

      bbad0d0174334cf90ed6d1ba88fbbcd0

    • SHA1

      6c3bc5b3ffd9cbc77a8b253971211a6e68053287

    • SHA256

      021dd782c1aa99d4a6bd4fd57a843a2fdc7b63820ae41e6157b9baaf7ac3fa36

    • SHA512

      d4b923b672f4a4aea10b343a3d42fa33f6a44d3cd850e452a7d78bed716c9ae059c816797845ca0393abf08ca7681c55a664d727088b36832f7907c1a24b08ce

    • SSDEEP

      49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNec1:V8e8e8f8e8e8+

    Score
    10/10
    warzonerataspackv2discoveryevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzonerat family

      warzonerat

    • Warzone RAT payload

      rat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks