MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1842a949efbc8881d7bbe5e6a73385800c0376bd52071ce86dfdb6df60026bbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Zyklon


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1842a949efbc8881d7bbe5e6a73385800c0376bd52071ce86dfdb6df60026bbc
SHA3-384 hash: 4971abbe91d8d2eef642e1b8fbbc82b4e6fd92472a480b435e9dfdfcacbf57e98df896aa62d0461eabc1f4009db5db95
SHA1 hash: 327355c2ef33c83c318c52b7e2ca0a8e05c03640
MD5 hash: 70add2e399bd523776e8fcd5f86e842c
humanhash: timing-zebra-ink-four
File name:1842A949EFBC8881D7BBE5E6A73385800C0376BD52071.exe
Download: download sample
Signature Zyklon
Create hunting rule
File size:1'936'896 bytes
First seen:2024-02-04 04:45:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'817 x AgentTesla, 19'740 x Formbook, 12'286 x SnakeKeylogger)
ssdeep 49152:byUmdKMMFOQpF2w9BWfN9oMNbrks7IrnZrgz//p:byUmdTQpFlWfNaMNfkSIZrg
Threatray 180 similar samples on MalwareBazaar
TLSH T170959E0699626E33C2997B7986D7001E43B0C6A37567FF1B3A1F30B1AD066319F562F2
TrID 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.8% (.SCR) Windows screen saver (13097/50/3)
8.7% (.EXE) Win64 Executable (generic) (10523/12/4)
5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter abuse_ch
Tags:exe Zyklon


Avatar
abuse_ch
Zyklon C2:
http://85.209.9.184/Game/3/SecuretestUniversal/phpJsHttpProcessorAuthSqlWp.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
415
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/474458/
Detection(s):
Win.Packed.Uztuby-10009381-0
Create hunting rule

Win.Packed.Uztuby-10015036-0
Create hunting rule

Win.Packed.Uztuby-10015799-0
Create hunting rule

Win.Packed.Uztuby-10015902-0
Create hunting rule

Win.Packed.Uztuby-10017372-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/65bf168bdc0e133d92c12484/reports/ed87c651-1655-4524-a79c-edc0fd02b08d/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/1842a949efbc8881d7bbe5e6a73385800c0376bd52071ce86dfdb6df60026bbc
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/08763717-7727-441a-915b-d6b0b84c054e
Result
Threat name:
DCRat, PureLog Stealer, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1386267
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops PE files to the user root directory
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Files With System Process Name In Unsuspected Locations
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected DCRat
Yara detected PureLog Stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1842a949efbc8881d7bbe5e6a73385800c0376bd52071ce86dfdb6df60026bbc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1842a949efbc8881d7bbe5e6a73385800c0376bd52071ce86dfdb6df60026bbc/
Threat name:
ByteCode-MSIL.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2023-12-03 20:51:34 UTC
File Type:
PE (.Net Exe)
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dbbkssppxseidv534xtkom4fqagag5v5kidrz2dn7w3n6yacno6a._file
Verdict:
malicious
Similar samples:
0688ce617e2e8af025340b42e79620a52527962ee200f9efd29b664282845ac5
Zyklon
13e063bc39be5c694f3bb67deead2b8a4781d98a0c26cc2d8ec68e0a72726dc7
Zyklon
21aed8462506d9f38c45cea33783a3d532f73c97a1ee1b4f35470d3cf4db699a
Zyklon
3052de74bcdc2e2028ee5bd91e8ad654aa166d38a2715f3ac6e5a5501c1e14e8
Zyklon
3477199ac35c44688a69664eb2d722607cff4e3a376a2d066eace87fe016debc
Zyklon
46e646dcfb73f26f153653b020f9871da0dc1bbd39b518e159616e352ebee9fc
Zyklon
8d4d7a9744daead89a8e5af92249aa6d709e4f91ff33c774ba6e8c8289ec2020
Zyklon
975033d24044a83505ee98f9f3b857e114ccb5f6179db6dce90804af911eea8f
Zyklon
b107d13d86463788a3f85ae223f77014034229e0a5746bb871c37bc11c1ba0f4
Zyklon
e4a811441488a49a640f234d4e514d6746ad7ea39c4f1fe750182a358acc4d0d
Zyklon
+ 170 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:zgrat rat spyware stealer
Link:
https://tria.ge/reports/240204-fdy1pscbhm/
Behaviour
Modifies registry class
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
2b93377ea087225820a9f8e4f331005a0c600d557242366f06e0c1eae003d669
MD5 hash:
d8bf2a0481c0a17a634d066a711c12e9
SHA1 hash:
7cc01a58831ed109f85b64fe4920278cedf3e38d
Link:
https://www.unpac.me/results/47b75aea-57f3-4a3a-8598-684e5acacb6f/
SH256 hash:
7c95d3b38114e7e4126cb63aadaf80085ed5461ab0868d2365dd6a18c946ea3a
MD5 hash:
e9ce850db4350471a62cc24acb83e859
SHA1 hash:
55cdf06c2ce88bbd94acde82f3fea0d368e7ddc6
Link:
https://www.unpac.me/results/47b75aea-57f3-4a3a-8598-684e5acacb6f/
SH256 hash:
1842a949efbc8881d7bbe5e6a73385800c0376bd52071ce86dfdb6df60026bbc
MD5 hash:
70add2e399bd523776e8fcd5f86e842c
SHA1 hash:
327355c2ef33c83c318c52b7e2ca0a8e05c03640
Detections:
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Link:
https://www.unpac.me/results/47b75aea-57f3-4a3a-8598-684e5acacb6f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1842a949efbc8881d7bbe5e6a73385800c0376bd52071ce86dfdb6df60026bbc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with unregistered version of .NET Reactor
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/474458/

Comments