Overview

overview

10

Static

static

10

svchost_du...py.exe

windows7-x64

10

svchost_du...py.exe

windows10-1703-x64

10

svchost_du...py.exe

windows10-2004-x64

10

svchost_du...py.exe

windows11-21h2-x64

10

Resubmissions

23-01-2024 14:03

240123-rcwpqsbff3 10

23-01-2024 13:44

240123-q13yaabef7 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svchost_dump_SCY - Copy.bin.zip

  • Size

    2.4MB

  • MD5

    1a2f128d6c8b5873ea628daea3f14676

  • SHA1

    1a92a3a742952b6cfa7486fc796c8d5ea133fd5f

  • SHA256

    f04d11a1c4811492e397bc151c65ea1958eab6cbcf279ece7bd59160bfbea3d8

  • SHA512

    c365cd4224cb652d0790ac9dab846a676e10e146e25861c25941a5adbe71ed232ff9826189c250a21424b3ac12cf2a9a92e47cb870cffd31f66774d0ecca5331

  • SSDEEP

    49152:uZm0/SR/6qlcjHAQhFF2g+X6JWj4JBhhK9bBPYtsN/hvWl6TWDwMYXECjG:uZf/SgqlcjgCFo6JW28b1IsN5vW8GMEf

Score
10/10
trojanbazaloader

Malware Config

Signatures

  • Bazaloader family
    bazaloader
  • Detects BazaLoader malware 1 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

    trojan
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • svchost_dump_SCY - Copy.bin.zip
    .zip

    Password: infected

  • svchost_dump_SCY - Copy.bin
    .exe windows:6 windows x64 arch:x64

    Password: infected

    a36c1890ad00c18dd7657e5d32beb26c


    Headers

    Imports

    Sections