MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LaZagne


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05
SHA3-384 hash: f4629df428501dc9e33096c10ebd245b9cabe49ba00044128c33c654ed646ee55ce2a97ff21ff50ba959496d32f47d39
SHA1 hash: 0e62d10ff194e84ed8c6bd71620f56ef9e557072
MD5 hash: 282df7bcb720a5b6f409caf9ccda2f75
humanhash: fourteen-fillet-eight-montana
File name:282df7bcb720a5b6f409caf9ccda2f75.exe
Download: download sample
Signature LaZagne
Create hunting rule
File size:11'849'245 bytes
First seen:2023-03-10 06:52:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7aa1951517b3b8d38b12f874b66196c9 (2 x CobaltStrike, 1 x LaZagne)
ssdeep 196608:0cHu78K//UoEkXuWJysVYvsOfhumHhtdIQLOMIdiwXa6vTVzy/BOfN1XZuoJnB:Bu7L//HEnWJIuahtaL/dg67RywfNxZuu
Threatray 20 similar samples on MalwareBazaar
TLSH T1B1C6331122B121B3FAE54635C562D832A476FC360B62C46A83F405777C97EEAB63DF60
TrID 43.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
27.6% (.EXE) Win64 Executable (generic) (10523/12/4)
13.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) OS/2 Executable (generic) (2029/13)
5.2% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon aebc385c4ce0e8f8 (10 x PythonStealer, 7 x RedLineStealer, 7 x DCRat)
Reporter abuse_ch
Tags:exe Lazagne

Intelligence

File Origin
# of uploads :
1
# of downloads :
265
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
lazagne
Create hunting rule
ID:
1
File name:
282df7bcb720a5b6f409caf9ccda2f75.exe
Verdict:
Malicious activity
Analysis date:
2023-03-10 06:52:58 UTC
Tags:
stealer lazagne
Link:
https://app.any.run/tasks/7722fa44-e0a4-4c48-8e0d-7757371900f0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LaZagne
Create hunting rule
Link:
https://www.capesandbox.com/analysis/373212/
Detection(s):
Win.Trojan.Lazagne-6779429-0
Create hunting rule

SecuriteInfo.com.Generic.Exploit.Shellcode.2.8A834396.12339.1511.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a file
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/72431/overview
Behaviour
MalwareBazaar
MeasuringTime
CPUID_Instruction
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware lazagne overlay packed python stealer virus
Link:
https://www.filescan.io/uploads/640ad3d11eb344cec842f9c3/reports/faf7a5c5-fcbf-4281-b4b4-be48d216abfb/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/430f44b9-02ef-4aa2-b87e-65a6c0c87168
Result
Threat name:
LaZagne, Mimikatz
Create hunting rule
Detection:
malicious
Classification:
rans.troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1190927
Signature
Found potential ransomware demand text
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected LaZagne password dumper
Yara detected Mimikatz
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05/
Threat name:
Win64.Hacktool.Lazagne
Create hunting rule
Status:
Malicious
First seen:
2023-02-22 21:42:15 UTC
File Type:
PE+ (Exe)
Extracted files:
429
AV detection:
17 of 39 (43.59%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=htc65e5jxip4k44jobjihn3azc6wd426somlx6rscdrl5t3njmcq._file
Verdict:
unknown
Similar samples:
20632d113408af16371070219ed4e9f260a3cc23db39fcddce2580ebf6669b5f
LaZagne
3b68780719010fc195e6e4f8d1b912030259cb1cddde5a943e44da558222060f
LaZagne
4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8
LaZagne
5585750ed182014fa4e52414ff733348ddd324f22f8ca2b476460273cba3d133
LaZagne
61b16d71a76f83cef63d079b0735cd0a1cee24f1119063e28ef1f227f2bb27c4
LaZagne
6ae3599bcbb951c7fe73ab6060a654b5ced2e83cf3ff15038bec95743232425e
LaZagne
88214cd533e440416cb5fec9e1a419ad952cd3524274110eaa8ce8e1dbcd826a
LaZagne
aa7021b2e15ae62168b9734f62bd01c59f2e93be1e7937e74a599fb63360915a
LaZagne
f976cfadb68d079d3190bb3b256e6a5e216f1d33ef0cfb4bd0639c062be690e9
LaZagne
fd81b3ed300db65a7a31b2b10011c9bfa9a2349571e2ccb532bc714856241b8e
LaZagne
+ 10 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/230310-hnm3asdg2t/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Unpacked files
SH256 hash:
3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05
MD5 hash:
282df7bcb720a5b6f409caf9ccda2f75
SHA1 hash:
0e62d10ff194e84ed8c6bd71620f56ef9e557072
Link:
https://www.unpac.me/results/95403417-52ad-418c-9adf-3617fe611256/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
LaZagne
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HKTL_Lazagne_Gen_18
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Lazagne password extractor hacktool
Reference:https://github.com/AlessandroZ/LaZagne
Rule name:HKTL_Lazagne_Gen_18_RID2DA6
Create hunting rule
Author:Florian Roth
Description:Detects Lazagne password extractor hacktool
Reference:https://github.com/AlessandroZ/LaZagne
Rule name:INDICATOR_TOOL_PWS_LaZagne
Create hunting rule
Author:ditekSHen
Description:Detects LaZagne post-exploitation password stealing tool. It is typically embedded with malware in the binary resources.
Rule name:LaZagne
Create hunting rule
Author:@bartblaze
Description:Identifies LaZagne, credentials recovery project.
Reference:https://github.com/AlessandroZ/LaZagne
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LaZagne

Executable exe 3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2564893/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/373212/

Comments