MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00fb52d7792f50ec51460c7e8ddc9bc9d951747b5f2f2c5abc246feb7ca2691b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


zgRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 8 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00fb52d7792f50ec51460c7e8ddc9bc9d951747b5f2f2c5abc246feb7ca2691b
SHA3-384 hash: ea079e0a4a5c6db6802a6c56c807da996f49a1590bd5e2b0ec35359ba53ee806e1a782e54aa15dda634b97389374adef
SHA1 hash: aada134c1c4d16732af690c18fbae835ca521ce9
MD5 hash: b01570c3385fd970cc3130dcb01d1643
humanhash: mountain-iowa-maine-pizza
File name:b01570c3385fd970cc3130dcb01d1643
Download: download sample
Signature zgRAT
Create hunting rule
File size:1'731'656 bytes
First seen:2023-11-30 09:36:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:JoCqawGOVMNh76qeEwodiiwioxSC6XPABFRdtVbR7hilaUjC8EgBH0rKGGbank:JoJa0uRkodiiwioUCa4DRd/wDjEgB4nk
Threatray 26 similar samples on MalwareBazaar
TLSH T14C859E8527852EA7C39E0E33D0F6EF7BCBE6C571A34BE345644029A55CD63B28E022D1
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 489669d8d8699648 (53 x AgentTesla, 24 x SnakeKeylogger, 16 x AveMariaRAT)
Reporter zbetcheckin
Tags:32 exe zgRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
328
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ccfc0e5dbe36a948d8ffd3ac3e07cb23.exe
Verdict:
Malicious activity
Analysis date:
2023-11-30 07:49:27 UTC
Tags:
pureloader loader
Link:
https://app.any.run/tasks/0dc8eba2-e663-4a41-9951-77054bb345fc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/461371/
Detection(s):
Win.Packed.Dropperx-10015353-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Launching a process
Sending an HTTP GET request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/00fb52d7792f50ec51460c7e8ddc9bc9d951747b5f2f2c5abc246feb7ca2691b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6c11d482-3e20-459c-b8cb-c462680c26eb
Result
Threat name:
zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1350454
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Connects to many ports of the same IP (likely port scanning)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Set autostart key via New-ItemProperty Cmdlet
Snort IDS alert for network traffic
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Yara detected Costura Assembly Loader
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1350454 Sample: r3fZye8NZA.exe Startdate: 30/11/2023 Architecture: WINDOWS Score: 100 41 Snort IDS alert for network traffic 2->41 43 Antivirus detection for URL or domain 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 6 other signatures 2->47 8 r3fZye8NZA.exe 3 2->8         started        11 r3fZye8NZA.exe 2 2->11         started        13 r3fZye8NZA.exe 2 2->13         started        process3 signatures4 49 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 8->49 51 Suspicious powershell command line found 8->51 53 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 8->53 57 3 other signatures 8->57 15 r3fZye8NZA.exe 2 8->15         started        19 r3fZye8NZA.exe 8->19         started        21 r3fZye8NZA.exe 8->21         started        55 Injects a PE file into a foreign processes 11->55 23 r3fZye8NZA.exe 11->23         started        25 r3fZye8NZA.exe 11->25         started        27 r3fZye8NZA.exe 13->27         started        process5 dnsIp6 33 91.92.252.74, 49732, 56001, 56002 THEZONEBG Bulgaria 15->33 35 Suspicious powershell command line found 15->35 37 Found many strings related to Crypto-Wallets (likely being stolen) 15->37 39 Tries to harvest and steal Bitcoin Wallet information 15->39 29 powershell.exe 1 11 15->29         started        signatures7 process8 process9 31 conhost.exe 29->31         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/00fb52d7792f50ec51460c7e8ddc9bc9d951747b5f2f2c5abc246feb7ca2691b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00fb52d7792f50ec51460c7e8ddc9bc9d951747b5f2f2c5abc246feb7ca2691b/
Threat name:
Win32.Trojan.CrypterX
Create hunting rule
Status:
Malicious
First seen:
2023-11-30 09:37:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ad5vfv3zf5ioyukgbr7i3xe3zhmvc5d3l4xsywv4erx6w7fcnenq._file
Verdict:
malicious
Similar samples:
00fb52d7792f50ec51460c7e8ddc9bc9d951747b5f2f2c5abc246feb7ca2691b
zgRAT
19227c3cbaf6fe7441ed47f9e7a759d398ab55156af4cde8329d855e51ca79c9
zgRAT
3570d5a817fb0dada6cd6e486695a3f8bdb4cc7b6e0bd33b8ebca43d781afb65
zgRAT
3e9471385936da8656e7a1bc53d44271ec437d1399cd33ad91091b1f286c878b
zgRAT
893c11889ab845e5ab82ff106d2f6fe25de01fd7e80bfaa05909d86a3b54738e
zgRAT
afd0d6d2b9cd517f73b578b5845d729c88876910e359034a3f15dcd93c5e506e
zgRAT
ca340328a09ac92cb4560a3ae9b479d314c5aa1eb551e38bf138034cd41abce7
zgRAT
+ 16 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:zgrat persistence rat
Link:
https://tria.ge/reports/231130-llgdhsac9y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
e0e9be4dc1483f5c2f86b675e9a84642a588db800483f61f86c00d7caf836bac
MD5 hash:
806f788bc7b48c981e75bbdce93428c6
SHA1 hash:
71b9c4ae53f4ad6863bf8248a068b2c0097071b0
Link:
https://www.unpac.me/results/7f69590d-47b8-4e24-b4b6-9fecdc83c1e3/
SH256 hash:
98d99f05f53560728a597fc2037f02a7bc61d2bf936a8b2cb3868843976194e6
MD5 hash:
69b4b445a510f8ce07e7508e33384b3a
SHA1 hash:
d7283b436bba41399c344c2edef46f8799876f45
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/7f69590d-47b8-4e24-b4b6-9fecdc83c1e3/
SH256 hash:
75ff6f3eec3adb7d171f44d9a19238801c94e268510a82d8e61e62140db372a5
MD5 hash:
57a27bdc0b78631612c257dded390f7d
SHA1 hash:
cbee7361dd59a4887b892011fb16fac9e6692ddc
Link:
https://www.unpac.me/results/7f69590d-47b8-4e24-b4b6-9fecdc83c1e3/
SH256 hash:
c1c65066690044dadc32b0c74736db7fd9b7e7ba653e6e76ad1f85eb7b7a7c9a
MD5 hash:
26e1b51ee13ff3a4d1c66c07b1591393
SHA1 hash:
be1e443db4f58ba89504f7e206614d86a804caf7
Link:
https://www.unpac.me/results/7f69590d-47b8-4e24-b4b6-9fecdc83c1e3/
SH256 hash:
1341202f4a445dad1a71a2143fe24ab4d8efbe6c6db923e42014ff3fb6c38877
MD5 hash:
67a3d36464664919e7b6b9e472fff6dc
SHA1 hash:
3cc9541a0fc172bcb533c9f4f912dcfcc764ba30
Link:
https://www.unpac.me/results/7f69590d-47b8-4e24-b4b6-9fecdc83c1e3/
SH256 hash:
7f70ffd1d633a38ae144222bd19aacddeb8d227de60032980b061de60d2a4088
MD5 hash:
5c1e38c709d8b1d8910f6d1ed543985d
SHA1 hash:
3849b2b9bb1767ce2a20b432b16777efbf2e469b
Link:
https://www.unpac.me/results/7f69590d-47b8-4e24-b4b6-9fecdc83c1e3/
SH256 hash:
7d213db6f0b814063d467b8acc5ba162b676a811eb62bf75c188ca4f77d924b4
MD5 hash:
a01f359891a49fe8b1257d933d10e64f
SHA1 hash:
2cc045dc148a4eb31e50813b67b0763f00f3df35
Link:
https://www.unpac.me/results/7f69590d-47b8-4e24-b4b6-9fecdc83c1e3/
SH256 hash:
00fb52d7792f50ec51460c7e8ddc9bc9d951747b5f2f2c5abc246feb7ca2691b
MD5 hash:
b01570c3385fd970cc3130dcb01d1643
SHA1 hash:
aada134c1c4d16732af690c18fbae835ca521ce9
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/7f69590d-47b8-4e24-b4b6-9fecdc83c1e3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/00fb52d7792f50ec51460c7e8ddc9bc9d951747b5f2f2c5abc246feb7ca2691b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zgRAT

Executable exe 00fb52d7792f50ec51460c7e8ddc9bc9d951747b5f2f2c5abc246feb7ca2691b

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2736359/
Cape
Cape
https://www.capesandbox.com/analysis/461371/

Comments


Avatar
zbet commented on 2023-11-30 09:36:46 UTC

url : hxxp://94.156.71.74/bnh.exe