Extracted

• • Target
    atelier2/sample1
  • Size 15.6MB
  • SHA256 a267a87d74e15c2b281f4268cf1e3d7e5c5586cf856549528e42d9436e04c9b9
  • MD5 6b348a39a04048f52114c2431dab3013
  • SHA1 f5871c6aad24a5bf6b9124e34720769a707daa35
  • SHA512 0b4f6eb3d1a66bae6e791862cb59d6a6d95a2a21f6aed6933dab73be0be2d1e9f9695f164f5f30873e1d985e9f5b8ce820823c0ebc68e845f69cfbedccc7dece
  • SSDEEP 393216:W+HuMHZKZxlHOFXlABlh2pDOHuHOnoLq0JTt3p:W+O4MByCHQpDdHXq0JR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  spywarestealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2
• • Target
    atelier2/sample2
  • Size 257KB
  • SHA256 18ec681c471f185edf3ab8e23b52b4ea2a87162f9957b4d5d10ac0e2bc008405
  • MD5 07c86dadcc51ffcb395a496086a79ec9
  • SHA1 db1b4ce23007f85683ff72fb6ea6821ad8a14b44
  • SHA512 a5327dac75b2ac00919f267594e02924ef7188426bb7f75bb4e06a7f2330cc7c3332cea9185a194017b3d9ec8053389b2ffabdbf34cb931c1e91b926c2883bcf
  • SSDEEP 6144:K8MWRKxuE2YD+YUa1hp+V0bh9LjfYM8yJRub4NK:KMROuE2c++i0Djf18QRJK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoverywarzoneratinfostealerpersistencerat

  • Modifies WinLogon for persistence

    persistence

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    atelier2/sample3
  • Size 17.3MB
  • SHA256 1c0b5baceb177598bafee74d48d91567428e3033521caec287021164db19b96e
  • MD5 0377166caf38438de4232fb6a86893f2
  • SHA1 67d46b924111c8d1ea88ea9f45499d469f926495
  • SHA512 5cbbfae5d8113cb7aab5afb8d3805151f9c64e979f95f3af5a986ae23ab0f0f7e8570d6b34443b87d01dd03ffb9687aa5151c62b38369235c5cb925dcbc75fe1
  • SSDEEP 393216:JAFd1z11zFoBV360BGwbh5GyktRUuc3G/lr96rLG09hk3Doi+:JAFn17S60AwetSu6G9Z6r6Shk8i
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  backdoordefense_evasiondiscoveryrmsruratpersistenceratspywaretrojanupx

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms

  • Rms family

    rms

  • RuRAT

    RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.

    trojanbackdoorrurat

  • Rurat family

    rurat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral5behavioral6