General
-
Target
23c32832b80a9530e2fdf1cd335585847cb25bb11c3c8e3008bb3e34c415532fN
-
Size
2.9MB
-
Sample
250113-gp47ja1qhj
-
MD5
0981843c2e0c2722ceffd71d48849b80
-
SHA1
86f71db7708588eab7d9aeb3603cdbc0bbff3d22
-
SHA256
23c32832b80a9530e2fdf1cd335585847cb25bb11c3c8e3008bb3e34c415532f
-
SHA512
aa1ef006d3b86edff7aabd28613535eae082db8f6e57c1a107bd445809b756680b63fcadfed77ddea18dabe9e922c17508555c9e2083cff93f3f36bd4c3ef77a
-
SSDEEP
24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHi:ATU7AAmw4gxeOw46fUbNecCCFbNecl
Malware Config
Targets
-
-
Target
23c32832b80a9530e2fdf1cd335585847cb25bb11c3c8e3008bb3e34c415532fN
-
Size
2.9MB
-
MD5
0981843c2e0c2722ceffd71d48849b80
-
SHA1
86f71db7708588eab7d9aeb3603cdbc0bbff3d22
-
SHA256
23c32832b80a9530e2fdf1cd335585847cb25bb11c3c8e3008bb3e34c415532f
-
SHA512
aa1ef006d3b86edff7aabd28613535eae082db8f6e57c1a107bd445809b756680b63fcadfed77ddea18dabe9e922c17508555c9e2083cff93f3f36bd4c3ef77a
-
SSDEEP
24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHi:ATU7AAmw4gxeOw46fUbNecCCFbNecl
Score10/10-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4