General

  • Target

    b858a1f896ba459493486676e59af5ad

  • Size

    152KB

  • Sample

    240307-kzbvhsfg76

  • MD5

    b858a1f896ba459493486676e59af5ad

  • SHA1

    c8a0ba42f8076b5c2b0d4cd2e0e6225b509b9f0c

  • SHA256

    fb55340ef36d5bfae56dd84e51b9aff7996ab7428fd1fcbe53dfb8fdcda244e8

  • SHA512

    cab1bf9703921eba97b4686c03583ec8d27b6d8ba6b869e8be7983071d513c9ce1347a345f931365db214de3918e417f0c0c1fa35e5ec681b3a0ee7c59fd87c1

  • SSDEEP

    3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF

Malware Config

Extracted

Family

warzonerat

C2

sdafsdffssffs.ydns.eu:6703

Targets

    • Target

      b858a1f896ba459493486676e59af5ad

    • Size

      152KB

    • MD5

      b858a1f896ba459493486676e59af5ad

    • SHA1

      c8a0ba42f8076b5c2b0d4cd2e0e6225b509b9f0c

    • SHA256

      fb55340ef36d5bfae56dd84e51b9aff7996ab7428fd1fcbe53dfb8fdcda244e8

    • SHA512

      cab1bf9703921eba97b4686c03583ec8d27b6d8ba6b869e8be7983071d513c9ce1347a345f931365db214de3918e417f0c0c1fa35e5ec681b3a0ee7c59fd87c1

    • SSDEEP

      3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF

    • Detects BazaLoader malware

      BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks