Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    https://s3.us-east-005.backblazeb2.com/vx-underground-main/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.12.7z?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=005e2c099359ccf0000000004%2F20260731%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260731T161715Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=a653c36e226a582a18e19064a5d0318c95fb25ee6957836977d4ffdf2ba6cf60

  Score

  10^/10

  backdoorarmadanacional1defense_evasiondiscoveryexecutionagentteslabitratdjvunanocoreremcosrunningratsmokeloaderwarzoneratinfostealerinstallerkeyloggermacropersistenceprivilege_escalationransomwareratspywarestealertrojanupxxlm

  • AgentTesla payload

  • Detected Djvu ransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Family: Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Family: RunningRat

    RunningRat is a remote access trojan first seen in 2018.

    ratrunningrat

  • Family: SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Family: WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • RunningRat payload

  • Warzone RAT payload

    rat

  • Renames multiple (1530) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Suspicious Office macro

    Office document equipped with 4.0 macros.

    macroxlm

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • KoiVM .NET virtualizer plugin for ConfuserEx

    Detects KoiVM .NET virtualizer plugin for ConfuserEx

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1