bazaloader | 8988632c1f151363dcf5508756084830f38659c4f12117e18dc273786b5d0fb1

General

Target

7f016dfa5e22a08510e0ec5f5358bb67_JaffaCakes118
Size

323KB
Sample

241030-ngfyassepq
MD5

7f016dfa5e22a08510e0ec5f5358bb67
SHA1

d8d74e0421e5d43e7d4b7e91f3ed4f66881ee77e
SHA256

8988632c1f151363dcf5508756084830f38659c4f12117e18dc273786b5d0fb1
SHA512

586ec026bd7e9744652cbb921eda9002b5a840ed615c907e46b8f46ca3b9fc1ca6bbd96afec47b61eab8b089ce6cb0dcde41bebda364786539ea13bada7e3678
SSDEEP

6144:mvMt6V/hdmkcyvAIFtUx2yTF5vdzfaiWKBilS70e8mZC9TbUcuJJCoED:8MtehrcyvAI8MyT3lfjyS70e84QEO1D

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

tobi12345.hopto.org:50501

Targets

- Target
  
  8ee60423bc1f9d704f96b7806b39819a.exe
- Size
  
  322KB
- MD5
  
  909737a0a11765901cdce436737ac172
- SHA1
  
  00d77473c837e0ed2887d6285a6c3c9e47ec83c8
- SHA256
  
  39cd390039e7ad850abd64cfc0b387c77470153c09d35108cf96a893185804a2
- SHA512
  
  e0989e9178201f126cc600b2d64c3609ff58f7ee3ab55f177fd7301f32cf13322afe7fdbe7334c52892ffc4f5b193fb38d841371c196ac44341bd54211dab2a2
- SSDEEP
  
  6144:+vMt6V/hdmkcyvAIFtUx2yTF5vdzfaiWKBilS70e8mZC9TbUcuJJCoED:EMtehrcyvAI8MyT3lfjyS70e84QEO1D
Score

10^/10

bazaloader warzonerat discovery infostealer rat trojan
- Bazaloader family
  bazaloader
- Detects BazaLoader malware
  BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests - JaffaCakes118.
  trojan
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzonerat family
  warzonerat
- Warzone RAT payload
  rat
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Bazaloader family

Detects BazaLoader malware

WarzoneRat, AveMaria

Warzonerat family

Warzone RAT payload

Drops startup file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.