Overview

overview

10

Static

static

10

ba3d2569f7...c5.exe

windows7-x64

10

ba3d2569f7...c5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba3d2569f715cba001a95907847740c5

  • Size

    152KB

  • Sample

    240308-cf8fdadd2z

  • MD5

    ba3d2569f715cba001a95907847740c5

  • SHA1

    6110a97db563b5044e38f45fc420ae5669b8ba9c

  • SHA256

    469301f8da3a3ddf892007d92eb5df11810dc36dd9487014073ac49f4bdb70e5

  • SHA512

    e0fe62a76ba3c111d11f209ddfdfdf5650a6d4d797791d48f1f4b6db2193d676e207591c97e95d9e0ba2d77460f2286abe99c93fe0a98761629fac30f7a2b751

  • SSDEEP

    3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF

Score
10/10
bazaloaderwarzoneratinfostealerrattrojan

Malware Config

Extracted

Family

warzonerat

C2

kezlkelz.duckdns.org:8888

Targets

    • Target

      ba3d2569f715cba001a95907847740c5

    • Size

      152KB

    • MD5

      ba3d2569f715cba001a95907847740c5

    • SHA1

      6110a97db563b5044e38f45fc420ae5669b8ba9c

    • SHA256

      469301f8da3a3ddf892007d92eb5df11810dc36dd9487014073ac49f4bdb70e5

    • SHA512

      e0fe62a76ba3c111d11f209ddfdfdf5650a6d4d797791d48f1f4b6db2193d676e207591c97e95d9e0ba2d77460f2286abe99c93fe0a98761629fac30f7a2b751

    • SSDEEP

      3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF

    Score
    10/10
    warzoneratinfostealerrattrojan

    • Detects BazaLoader malware

      BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

      trojan

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks