General
-
Target
b858a1f896ba459493486676e59af5ad
-
Size
152KB
-
Sample
240307-kzbvhsfg76
-
MD5
b858a1f896ba459493486676e59af5ad
-
SHA1
c8a0ba42f8076b5c2b0d4cd2e0e6225b509b9f0c
-
SHA256
fb55340ef36d5bfae56dd84e51b9aff7996ab7428fd1fcbe53dfb8fdcda244e8
-
SHA512
cab1bf9703921eba97b4686c03583ec8d27b6d8ba6b869e8be7983071d513c9ce1347a345f931365db214de3918e417f0c0c1fa35e5ec681b3a0ee7c59fd87c1
-
SSDEEP
3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF
Behavioral task
behavioral1
Sample
b858a1f896ba459493486676e59af5ad.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b858a1f896ba459493486676e59af5ad.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
warzonerat
sdafsdffssffs.ydns.eu:6703
Targets
-
-
Target
b858a1f896ba459493486676e59af5ad
-
Size
152KB
-
MD5
b858a1f896ba459493486676e59af5ad
-
SHA1
c8a0ba42f8076b5c2b0d4cd2e0e6225b509b9f0c
-
SHA256
fb55340ef36d5bfae56dd84e51b9aff7996ab7428fd1fcbe53dfb8fdcda244e8
-
SHA512
cab1bf9703921eba97b4686c03583ec8d27b6d8ba6b869e8be7983071d513c9ce1347a345f931365db214de3918e417f0c0c1fa35e5ec681b3a0ee7c59fd87c1
-
SSDEEP
3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF
Score10/10-
Detects BazaLoader malware
BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Executes dropped EXE
-
Loads dropped DLL
-