MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19b872715d505e38a2163825026954d98760093ce668a77d427db77b29fac04f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

zgRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	19b872715d505e38a2163825026954d98760093ce668a77d427db77b29fac04f
SHA3-384 hash:	feb854da7d1a2ed697f2a27abc6e84a4e34a4bfd240252685b26cbff230097a5daadcc149ed0f161859d67b8c89d4807
SHA1 hash:	dabea87145a97a96a2dbaeaa6e20a1b6223e3337
MD5 hash:	cd4c717881e071875deae2d9ae7bb0d7
humanhash:	sixteen-freddie-massachusetts-pip
File name:	FF.exe
Download:	download sample
Signature	zgRAT Create hunting rule
File size:	8'123'904 bytes
First seen:	2023-04-06 06:13:00 UTC
Last seen:	2023-04-06 07:02:37 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	49152:7jAhmnqSqWHGz+uSFo0kjX/St3Jd4Vmb5afa5LhEoTU9a+VVQUtIgiv/TXQudQSL:HDuZiMYbZ5LWoTUweVQsd0G
TLSH	T172862B83B69699A2E6B92333C5E606094FF1F8416213DB0D30CE235A3F537A66D43797
TrID	56.5% (.EXE) Win64 Executable (generic) (10523/12/4) 11.0% (.ICL) Windows Icons Library (generic) (2059/9) 10.9% (.EXE) OS/2 Executable (generic) (2029/13) 10.7% (.EXE) Generic Win/DOS Executable (2002/3) 10.7% (.EXE) DOS Executable Generic (2000/1)
Reporter	Anonymous
Tags:	exe zgRAT

Intelligence

File Origin

# of uploads :

# of downloads :

269

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

IMG.23229000111.lnk

Verdict:

Malicious activity

Analysis date:

2023-04-06 05:53:22 UTC

Tags:

loader

Link:

https://app.any.run/tasks/0532ec2a-044b-43e1-abfe-03652a02d096

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/380508/

Detection(s):

SecuriteInfo.com.Win64.Trojan-gen.26828.6233.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Launching a process

Creating a process with a hidden window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% subdirectories

Unauthorized injection to a recently created process

Creating a file

Creating a window

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Sending an HTTP GET request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/642e62f205400511cafb470e/reports/57b5e358-cd75-4be0-a247-1c1f04eee326/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/19b872715d505e38a2163825026954d98760093ce668a77d427db77b29fac04f

Result

Verdict:

MALICIOUS

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/e0d315b2-51ca-45a5-abb1-f853e20e0d99

Result

Threat name:

zgRAT

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1209399

Signature

Antivirus detection for URL or domain

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/19b872715d505e38a2163825026954d98760093ce668a77d427db77b29fac04f/

Threat name:

ByteCode-MSIL.Trojan.Generic

Status:

Suspicious

First seen:

2023-04-06 00:47:42 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dg4he4k5kbpdriqwhasqe2ku3gdwacj44zuko7kcpw3xwkp2ybhq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

collection persistence spyware stealer

Link:

https://tria.ge/reports/230406-gyrmssdf2s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Checks computer location settings

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

19b872715d505e38a2163825026954d98760093ce668a77d427db77b29fac04f

MD5 hash:

cd4c717881e071875deae2d9ae7bb0d7

SHA1 hash:

dabea87145a97a96a2dbaeaa6e20a1b6223e3337

Link:

https://www.unpac.me/results/4b32ddca-a586-41f3-84ad-54dde8c8d352/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.