MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21ee878a13dec26e24cffdfaf3361130544ff2c444729faeffc48abeff66d67f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	21ee878a13dec26e24cffdfaf3361130544ff2c444729faeffc48abeff66d67f
SHA3-384 hash:	3e6876776a2aac0dd4ac13a0e93bab2dba08cc605e657da037d730079906f6c3fee0b814e81119381347e617ebc5e30a
SHA1 hash:	8e5ba06a70e916f42c239b987a1d747fb9b78fcf
MD5 hash:	04b8b769aecdd73f33fa411e10f781ea
humanhash:	oklahoma-arizona-colorado-enemy
File name:	Kczvgz.bin
Download:	download sample
Signature	zgRAT Alert Create hunting rule
File size:	166'912 bytes
First seen:	2026-11-11 23:46:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'361 x AgentTesla, 20'867 x Formbook, 12'418 x SnakeKeylogger)
ssdeep	3072:QXlfbKuURohM8KBteDRAq83nUnhodTr8G64UNLcECWXVRl:QXVKZ+KBsDCUhommALYW
TLSH	T1F2F31A36B6BF8E03C2A80631D8D6820013B9868D99F3F755748412D9ED137EBED56EC9
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	xor
Tags:	exe netreactor obfuscated RAT zgRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

190

Origin country :

US

Vendor Threat Intelligence

ACCE EAZfuscator_DotNet_Obfuscator NET_Reactor_DotNet_Obfuscator

Malware configuration found for:

EAZfuscator NETReactor

Details

Link:

https://research.acce.ciphertechsolutions.com/results/6aa9379c-3982-446e-acc8-7a79306e99a4/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-11 23:54:29 UTC

Tags:

netreactor

Link:

https://app.any.run/tasks/1821352a-d9fa-49cb-91b3-e6422c392c30

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/99475/

ClamAV Detected

Detection(s):

YARA.SIGNATURE_BASE_SUSP_NET_Msil_Suspicious_Use_Strreverse.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af4fe80c48f25399eb54215

Tags:

virus remo

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating synchronization primitives

Connection attempt

Sending a custom TCP request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 masquerade net_reactor obfuscated obfuscated packed reconnaissance vbnet

Link:

https://www.filescan.io/uploads/6af4fe7a2500cf4c7462391a/reports/b68d2edb-5fbb-4001-bbfb-bc1e68aeed3d/overview

Hybrid Analysis Trojan.Mardom.MN.Generic

Verdict:

Malicious

Labled as:

Trojan.Mardom.MN.Generic

Link:

https://www.hybrid-analysis.com/sample/21ee878a13dec26e24cffdfaf3361130544ff2c444729faeffc48abeff66d67f

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f1ff55fc-7fb2-45cc-a900-9202eb18aee5

Joe Sandbox zgRAT

Result

Threat name:

zgRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/2004323

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Antivirus / Scanner detection for submitted sample

Connects to many ports of the same IP (likely port scanning)

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/21ee878a13dec26e24cffdfaf3361130544ff2c444729faeffc48abeff66d67f

Malva.RE zgRAT

Verdict:

zgRAT

YARA:

17 match(es)

Tags:

.Net .Net Obfuscator .Net Reactor Executable Managed .NET PE (Portable Executable) PE File Layout RAT SOS: 0.89 Win 32 Exe x86 zgRAT

Link:

https://app.malva.re/file/04b8b769aecdd73f33fa411e10f781ea

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/21ee878a13dec26e24cffdfaf3361130544ff2c444729faeffc48abeff66d67f/

ReversingLabs TitaniumCloud Win32.Trojan.Multiverze

Threat name:

Win32.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-06-01 17:35:13 UTC

File Type:

PE (.Net Exe)

Extracted files:

4

AV detection:

23 of 36 (63.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ehxipcqt33bg4jgp7x5pgnqrgbke74weirzj7lx7ysfl573g2z7q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/261111-3syd2scy6t/

Behaviour

System Location Discovery: System Language Discovery

Threat.Zone Suspicious

Malware Family:

n/a

Verdict:

Suspicious

Tags:

rat

YARA:

msil_suspicious_use_of_strreverse SUSP_OBF_NET_Reactor_Indicators_Jan24 SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24 SUSP_NET_Msil_Suspicious_Use_StrReverse

Link:

https://app.threat.zone/submission/33926bf6-2825-4ba8-997d-f5ccc3779a72

VirusSign msil

Malware Family:

msil

Alert

Create hunting rule

Malicious:

True

Tags:

debug-check dotnet cpu-clock exe dynamic-loading

Link:

https://intel.virussign.com/intelligence/file/21ee878a13dec26e24cffdfaf3361130544ff2c444729faeffc48abeff66d67f

UnpacMe MALWARE_Win_zgRAT SUSP_NET_Msil_Suspicious_Use_StrReverse SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24 SUSP_OBF_NET_Reactor_Indicators_Jan24

Unpacked files

SH256 hash:

21ee878a13dec26e24cffdfaf3361130544ff2c444729faeffc48abeff66d67f

MD5 hash:

04b8b769aecdd73f33fa411e10f781ea

SHA1 hash:

8e5ba06a70e916f42c239b987a1d747fb9b78fcf

Detections:

MALWARE_Win_zgRAT

Alert

Create hunting rule

SUSP_NET_Msil_Suspicious_Use_StrReverse

Alert

Create hunting rule

SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24

Alert

Create hunting rule

SUSP_OBF_NET_Reactor_Indicators_Jan24

Alert

Create hunting rule

Link:

https://www.unpac.me/results/3495f873-6267-4cfa-9ac6-4ce3bc977cf9/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/21ee878a13dec26e24cffdfaf3361130544ff2c444729faeffc48abeff66d67f

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/99475/