Resubmissions
03/02/2025, 21:57
250203-1t5hmsvmat 1003/02/2025, 04:37
250203-e896saslgn 1031/01/2025, 18:35
250131-w8gmxatmc1 10Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
-
submitted
03/02/2025, 21:57
General
-
Target
bazaar.2020.02/Trojan.Win32.Agentb.exe
-
Size
98KB
-
MD5
f6c0f66dddb1c6e83a62c3a17b5e98b6
-
SHA1
00bbd7b66698ebc534bfcb42e65b8b30816458bd
-
SHA256
1e0cc4051f5ea6cb75b0df551bc5be60abc54ca51cd1611dc760aa245a0055dd
-
SHA512
84ed45502c8494bb75ffcb2b5a2dde5041201e924e3085313cc5d29e5e59a95ab7f1cf62fe8e24e450430151dd6ff401902df45dc193f389fba420ee683ac146
-
SSDEEP
1536:5Csejmb+6BQyusX1UjtA0uWRf/eloc/9T1jVEyp:AtD6jSm0uWRfCogTjVEG
Score
10/10
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\Trojan.Win32.Agentb.exe"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\Trojan.Win32.Agentb.exe"1⤵
- System Location Discovery: System Language Discovery