General
-
Target
ba3d2569f715cba001a95907847740c5
-
Size
152KB
-
MD5
ba3d2569f715cba001a95907847740c5
-
SHA1
6110a97db563b5044e38f45fc420ae5669b8ba9c
-
SHA256
469301f8da3a3ddf892007d92eb5df11810dc36dd9487014073ac49f4bdb70e5
-
SHA512
e0fe62a76ba3c111d11f209ddfdfdf5650a6d4d797791d48f1f4b6db2193d676e207591c97e95d9e0ba2d77460f2286abe99c93fe0a98761629fac30f7a2b751
-
SSDEEP
3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF
Score
10/10
Malware Config
Extracted
Family
warzonerat
C2
kezlkelz.duckdns.org:8888
Signatures
-
Bazaloader family
-
Detects BazaLoader malware 1 IoCs
BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.
-
Warzone RAT payload 1 IoCs
-
Warzonerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
ba3d2569f715cba001a95907847740c5
b9494f92817e4dfbe294ad842e8f1988
Headers
Imports
Sections