MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OffLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa
SHA3-384 hash: f5050dbf2b29362b96cddcf4244ba29e2e5f35b24477bdb2022ad67ba03a671c5a2b7860a8499a72d2accfe4e5dfef01
SHA1 hash: 8043c7a7c83858a8ba8a416d32d07135d0edc6f8
MD5 hash: f3253627375d8e590575a6eeffbdb3ad
humanhash: april-friend-mobile-east
File name:Egzgxemc_2025.12.21_07.39.29_SETUP.exe
Download: download sample
Signature OffLoader
Create hunting rule
File size:15'562'304 bytes
First seen:2025-12-22 23:17:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ac4ded70f85ef621e5f8917b250855be (68 x OffLoader, 5 x Tofsee, 5 x Gh0stRAT)
ssdeep 196608:hmDAXXzXvgiKxE7hfOK6qtz1XhOe5guqeyASnJLd7heIcQSpwmlIBj35w+Bt5n+q:hmqUigeOKZN1XMjxLRhAQ3Xw+d+q
Threatray 412 similar samples on MalwareBazaar
TLSH T13EF63327B28A233EE06E4B3B49B7D1600D3B7A51A55E8C46A7F04C8CCF691601D7E797
TrID 62.3% (.EXE) Inno Setup installer (107240/4/30)
24.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
6.1% (.EXE) Win64 Executable (generic) (10522/11/4)
2.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon c088891383a7a585 (1 x OffLoader)
Reporter Ling
Tags:exe OffLoader Trojan:Win32/Yomal!rfn Yomal


Avatar
CNGaoLing
Trojan:Win32/Yomal!rfn (Microsoft Defender)

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/01d0036a-a7ed-4768-bc6b-071c91e62ac2/
Malware family:
n/a
ID:
1
File name:
Egzgxemc_2025.12.21_07.39.29_SETUP.exe
Verdict:
Malicious activity
Analysis date:
2025-12-22 23:18:01 UTC
Tags:
rat stealer zgrat purehvnc netreactor rust
Link:
https://app.any.run/tasks/97178450-410d-4936-82e9-589ee0208ec4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45791/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6949d1bea6c88bb4cc23bb02
Tags:
shellcode asyncrat keylog word
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context embarcadero_delphi fingerprint inno installer installer installer-heuristic overlay packed tofsee
Link:
https://www.filescan.io/uploads/6949d1b73f8fdbf8e94f4196/reports/32782378-8057-4f65-9c93-4b401799832a/overview
Verdict:
Malicious
Labled as:
Backdoor.Script.LodaRat.a
Link:
https://www.hybrid-analysis.com/sample/03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-22T01:27:00Z UTC
Last seen:
2025-12-23T05:09:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.MSIL.Cryptos.gen Trojan.Win32.Shellcode.jvn Trojan.Win32.Shellcode.sb Trojan.MSIL.Donut.sb Trojan.MSIL.Crypt.sb HEUR:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1e5b0b65-9b03-41c5-bd64-18d2395941b0
Score:
76%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/f3253627375d8e590575a6eeffbdb3ad
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa/
Verdict:
Malicious
Threat:
Family.ZGRAT
Link:
https://tip.neiki.dev/file/03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aovvnntf4kxwocj6ci7bo7p73yquasw4qhoaoir7wk2ry4skr2va._file
Verdict:
malicious
Label(s):
unc_loader_078
Create hunting rule
Similar samples:
03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa
OffLoader
1a5a3ca3568d8f54e8e1516454ff0336d4ae4bc092e9439a67c7321b70cbd0fc
OffLoader
33fdb1d88108e070e964165d1ff0c2ca71625e30795d3af5b7d27d59339720bb
OffLoader
5c2458ab58bb10c023e9f88ed69d94c046501fce9e4181ea4a2e68ba458f07e4
OffLoader
64b97d63af694192e4d6ba57c278ec324eaf6c8700c0f7cade06f5a08da81f5a
OffLoader
d659ad9d00570077e5918aa2f53783c5e5b105ef10c7f776496332527776fc58
OffLoader
error
OffLoader
+ 402 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery installer
Link:
https://tria.ge/reports/251222-3ae5rayjhz/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
System Location Discovery: System Language Discovery
Executes dropped EXE
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8b44a6f8-c25a-45e4-be15-7705237e8f55
Unpacked files
SH256 hash:
03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa
MD5 hash:
f3253627375d8e590575a6eeffbdb3ad
SHA1 hash:
8043c7a7c83858a8ba8a416d32d07135d0edc6f8
Link:
https://www.unpac.me/results/adfd2cbc-1b99-4e72-80e1-f486e17adf5e/
SH256 hash:
00a6b074f4b9bd5df6a60aaf540006d3a2b25872854387e14279e0626598c793
MD5 hash:
9ec5883beeb42e9276f6a7d4d6034c78
SHA1 hash:
0ae716f457c059af182d9a8307da2a2b884d82e0
Link:
https://www.unpac.me/results/adfd2cbc-1b99-4e72-80e1-f486e17adf5e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/03ab56b665e2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Generic_Threat_c9003b7b
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OffLoader

Executable exe 03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/45791/

Comments