MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fba4c2bac1363433553b57b389916f759be99e350e8003bf3d2a5584ebe5f46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

zgRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments 1

SHA256 hash:	3fba4c2bac1363433553b57b389916f759be99e350e8003bf3d2a5584ebe5f46
SHA3-384 hash:	1306c1894e14dfb883a6c175c647a12bd5c57e4c9c208aa0d6e173348bdde507799c35d910a5bd218197157ae66f3b04
SHA1 hash:	6ffa229970d66077c1f98ed138d9fcaa28615257
MD5 hash:	b66591c56edf6f3aa7f31aa14879f2e2
humanhash:	louisiana-uranus-california-double
File name:	b66591c56edf6f3aa7f31aa14879f2e2
Download:	download sample
Signature	zgRAT Create hunting rule
File size:	1'120'256 bytes
First seen:	2022-09-18 01:36:13 UTC
Last seen:	2023-08-27 09:07:40 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	24576:qBLhoeG+gIZbZ3iqD8uaAsoAmhBPK/AzzP:qrlG+gIZb3DdaboBhByQ
Threatray	2'148 similar samples on MalwareBazaar
TLSH	T1D535023DF3894F27E9ADA2B1974FCBD34013982163D849A50C68A34D86B2779F9524CF
TrID	63.5% (.EXE) Win64 Executable (generic) (10523/12/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):
dhash icon	fab8d8d8dadadcc9 (2 x RedLineStealer, 2 x CoinMiner, 2 x Adware.MetaQuotes)
Reporter	zbetcheckin
Tags:	exe zgRAT

Intelligence

File Origin

# of uploads :

# of downloads :

405

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

b66591c56edf6f3aa7f31aa14879f2e2

Verdict:

No threats detected

Analysis date:

2022-09-18 01:37:11 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/814ef4a8-c1d6-4b7d-ab36-326bca3b297f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/311000/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.62025455.23553.26039.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Launching a process

Creating a process with a hidden window

Unauthorized injection to a recently created process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/632676b71183046074adcf11/reports/83bdbc72-c5fe-40ab-899e-ef45d3cd0942/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fca20f0b-9ab5-4eef-a76e-eb4609628234

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1072348

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Antivirus / Scanner detection for submitted sample

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3fba4c2bac1363433553b57b389916f759be99e350e8003bf3d2a5584ebe5f46/

Threat name:

Win64.Trojan.Pwsx

Status:

Malicious

First seen:

2022-09-13 09:33:31 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

24 of 41 (58.54%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h65eyk5mcnrugnktwv5trgiw65m35gpdkduaao7t2ksvqtv6l5da._file

Verdict:

malicious

Label(s):

asyncrat

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/220918-b1tbhseedm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in System32 directory

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/48b6bc1b-09e6-4279-be29-8c2a0c8de29b

Unpacked files

SH256 hash:

3fba4c2bac1363433553b57b389916f759be99e350e8003bf3d2a5584ebe5f46

MD5 hash:

b66591c56edf6f3aa7f31aa14879f2e2

SHA1 hash:

6ffa229970d66077c1f98ed138d9fcaa28615257

Link:

https://www.unpac.me/results/01760c2c-2bf8-4e1a-becc-a7031d0d4418/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3fba4c2bac13/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/3fba4c2bac1363433553b57b389916f759be99e350e8003bf3d2a5584ebe5f46

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.