MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43ef89e27ca9e14fe36f2626444fd52557aa7a62c59ce2dc13e8ec4bec2a7b7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


zgRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43ef89e27ca9e14fe36f2626444fd52557aa7a62c59ce2dc13e8ec4bec2a7b7b
SHA3-384 hash: 868de69631781f953a25cc7b35ab27f77e17b34af7e9fac9929b84f8198bda1fd2b286cafad66cea387fe589638b1c90
SHA1 hash: 0495152453a74a29cc4effcf06e34f6b5e0c0d99
MD5 hash: 90163fb614066a7abaa99b48bed01214
humanhash: romeo-lemon-mango-nevada
File name:SecuriteInfo.com.Win32.PWSX-gen.24784.25099
Download: download sample
Signature zgRAT
Create hunting rule
File size:875'520 bytes
First seen:2023-12-10 16:25:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:IBgOWP6i6+LhhQ0aRj1AYB5I9sT8eOQ0QpD3Ly6KZMWT8+ObVUG1ZiNZ0YapLlwn:ICgTlBPfOwI65WT8+Ob7X/HxClsfrY
TLSH T12C15238177AC4F11E97D4BFA1B67151293B7B96709B2F22C0DD2A5DE3B31B101322A93
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon b2b2301eb230b2b2 (11 x Formbook, 10 x MassLogger, 4 x AgentTesla)
Reporter SecuriteInfoCom
Tags:exe zgRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
264
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/464331/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win32.PWSX-gen.24784.25099.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6575e69a18cffa73b1e165e2/reports/63ebcad5-13c8-4ae2-bef0-66734772edcf/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/43ef89e27ca9e14fe36f2626444fd52557aa7a62c59ce2dc13e8ec4bec2a7b7b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eef58a1c-03b9-451b-b202-67e50150d1b8
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1357414
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/43ef89e27ca9e14fe36f2626444fd52557aa7a62c59ce2dc13e8ec4bec2a7b7b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43ef89e27ca9e14fe36f2626444fd52557aa7a62c59ce2dc13e8ec4bec2a7b7b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-12-10 16:26:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ipxytyt4vhqu7y3peyteit6vevl2u6tcywoofxat5dwex3bkpn5q._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:zgrat rat
Link:
https://tria.ge/reports/231210-txh1gsfhfq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
d88dc9a316d00aae5a1195e49fc3ad318224ea842d02e58f88bf22b09a978b13
MD5 hash:
3023dbbde0aa9c1e72421e4947b2ddf6
SHA1 hash:
f7bb65a6f5d40f1645562d8c1483ca52f53d3db0
Detections:
win_mofksys_auto
Create hunting rule
SUSP_Imphash_Mar23_2
Create hunting rule
Link:
https://www.unpac.me/results/5dfee0d8-93da-477d-b40f-db99387548e1/
Parent samples :
64aa3b6b174535490dfbd46d731118c3bc146d2463f4c2efaa2bfef3ec584070
f1c65a4c95ac59ee5774fd858b8e4cb9cdd3d1374894c33eabeef692f76f889e
496474c14635d8ec7b918d4faf166a7855da8a64b2765dceff976abbf4eebbc3
43ef89e27ca9e14fe36f2626444fd52557aa7a62c59ce2dc13e8ec4bec2a7b7b
5dadc4b400540ed0ce0cc4947ce32817c32d0e2b808c5c5a8519bcf7d56ce810
bd9d4a2d5627b27b2e43afd37b07ce6c6b2d64a7017def2020c2c1434eae1a2a
SH256 hash:
d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5
MD5 hash:
579197d4f760148a9482d1ebde113259
SHA1 hash:
cf6924eb360c7e5a117323bebcb6ee02d2aec86d
Link:
https://www.unpac.me/results/5dfee0d8-93da-477d-b40f-db99387548e1/
SH256 hash:
d804afada3b90b6a42f8da83c976d52f9e33db5056e5c48ffb272883c6afd70a
MD5 hash:
6720a3813b9ed241e300571bcfea3808
SHA1 hash:
b3e6ff5c10a26e92908da4d779195c07d515e797
Detections:
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/5dfee0d8-93da-477d-b40f-db99387548e1/
SH256 hash:
f4e91bd4f8e5545d21884be42730491880f617312b41b011c9cc114fb3d391a7
MD5 hash:
e161a3ac6bd71cd84eeb12551e99a7fc
SHA1 hash:
a74a5de9448ea37d71f6c4c20afc75a52578b683
Link:
https://www.unpac.me/results/5dfee0d8-93da-477d-b40f-db99387548e1/
SH256 hash:
7d968ee2ec1bf4c1bf9228f8f2794675de987ac83bac5f8c608963526a435ed3
MD5 hash:
1845455753429aeee7c7762ef407d8ea
SHA1 hash:
050f55f9458f419c8fec7b31cf80542849d33a76
Link:
https://www.unpac.me/results/5dfee0d8-93da-477d-b40f-db99387548e1/
SH256 hash:
43ef89e27ca9e14fe36f2626444fd52557aa7a62c59ce2dc13e8ec4bec2a7b7b
MD5 hash:
90163fb614066a7abaa99b48bed01214
SHA1 hash:
0495152453a74a29cc4effcf06e34f6b5e0c0d99
Link:
https://www.unpac.me/results/5dfee0d8-93da-477d-b40f-db99387548e1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/43ef89e27ca9e14fe36f2626444fd52557aa7a62c59ce2dc13e8ec4bec2a7b7b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/464331/

Comments