MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LaZagne

Vendor detections: 13

Intelligence 13 IOCs YARA 10 File information Comments

SHA256 hash:	467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486
SHA3-384 hash:	cf471d57ecdf477e333ee4c5a7c5c0ba5de43f19425f10de59365cc04317725ccc996fda0e02b768679eb1ce1bdea2c4
SHA1 hash:	a3fad01a0c10fde5b38267188860ea1da649697d
MD5 hash:	5075f994390f9738e8e69f4de09debe6
humanhash:	moon-kitten-paris-fix
File name:	l.exe
Download:	download sample
Signature	LaZagne Create hunting rule
File size:	10'132'516 bytes
First seen:	2024-08-05 09:02:51 UTC
Last seen:	2024-09-14 20:53:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ba5546933531fafa869b1f86a4e2a959 (10 x DCRat, 3 x RedLineStealer, 2 x RemcosRAT)
ssdeep	196608:7Ho2jlyICteEroXxUKQGa3hQgWihENE+sKsXXg+W+TA3ek9WWaC+RnQp:xsInEroXGBGa3h3osKkXg+W+TA37eBns
TLSH	T14EA6334467F400FFF9FB49398591C61090B5BC670B96D09B43F843AB1F97AD22E2AB58
TrID	53.0% (.EXE) InstallShield setup (43053/19/16) 20.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.9% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 2.4% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	aebc385c4ce0e8f8 (10 x PythonStealer, 7 x RedLineStealer, 7 x DCRat)
Reporter	lontze7
Tags:	exe Lazagne

Intelligence

File Origin

# of uploads :

# of downloads :

446

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

https://objects.githubusercontent.com/github-production-release-asset-2e65be/30870954/39cbd3d6-89c5-417f-a996-b5ed2444e3eb?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240620%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240620T154438Z&X-Amz-Expires=300&X-Amz-Signature=826a9b3c9bd460ce4fa7409c2210bbd6cd960ca2813ac77f76678f19380b42a8&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=30870954&response-content-disposition=attachment%3B%20filename%3DLaZagne.exe&response-content-type=application%2Foctet-stream

Verdict:

No threats detected

Analysis date:

2024-06-20 15:46:36 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0c0076d3-6ee0-4ac1-acce-17663c847b52

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66b0954b037b02d0daedac34

Tags:

Credentials Encryption Execution Generic Infostealer Network Stealth Lazagne

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Restart of the analyzed sample

Creating a file

Running batch commands

Creating a process with a hidden window

Launching a process

Reading critical registry keys

Searching for the window

Stealing user critical data

Verdict:

Malicious

Labled as:

Application.Lazagne.E.Generic

Link:

https://www.hybrid-analysis.com/sample/467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/be49bcf3-fbc0-4ed2-8f4c-6e0b8e4a6713

Result

Threat name:

Python Stealer, LaZagne

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1465139

Signature

AI detected suspicious sample

Found pyInstaller with non standard icon

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potentially malicious time measurement code found

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Uses cmd line tools excessively to alter registry or file data

Yara detected Generic Python Stealer

Yara detected LaZagne password dumper

Behaviour

Behavior Graph:

Download SVG

Score:

94%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486/

Threat name:

Win64.Hacktool.Lazagne

Status:

Malicious

First seen:

2024-06-11 18:39:08 UTC

File Type:

PE+ (Exe)

Extracted files:

681

AV detection:

17 of 24 (70.83%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iz7et4pxsxa3basfvzrbywon6bw7mmh4cyy5yacz3knagkcyusda._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

9/10

Tags:

collection credential_access pyinstaller spyware stealer

Link:

https://tria.ge/reports/240805-kz1tmswblg/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Accesses Microsoft Outlook profiles

Credentials from Password Stores: Windows Credential Manager

Loads dropped DLL

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads ssh keys stored on the system

OS Credential Dumping: Security Account Manager

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/6e938b99-f2b1-4ba6-a3e4-5fc835ad1831

Unpacked files

SH256 hash:

467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486

MD5 hash:

5075f994390f9738e8e69f4de09debe6

SHA1 hash:

a3fad01a0c10fde5b38267188860ea1da649697d

Detections:

LaZagne

PyInstaller

LaZagne

HKTL_Lazagne_Gen_18

Link:

https://www.unpac.me/results/943bfd61-63bd-4352-b1e4-dd1f9b6aeaca/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	HKTL_Lazagne_Gen_18 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Lazagne password extractor hacktool
Reference:	https://github.com/AlessandroZ/LaZagne

Rule name:	HKTL_Lazagne_Gen_18_RID2DA6 Create hunting rule
Author:	Florian Roth
Description:	Detects Lazagne password extractor hacktool
Reference:	https://github.com/AlessandroZ/LaZagne

Rule name:	INDICATOR_TOOL_PWS_LaZagne Create hunting rule
Author:	ditekSHen
Description:	Detects LaZagne post-exploitation password stealing tool. It is typically embedded with malware in the binary resources.

Rule name:	LaZagne Create hunting rule
Author:	@bartblaze
Description:	Identifies LaZagne, credentials recovery project.
Reference:	https://github.com/AlessandroZ/LaZagne

Rule name:	PyInstaller Create hunting rule
Author:	@bartblaze
Description:	Identifies executable converted using PyInstaller.

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LaZagne

exe 467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3090168/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (FORCE_INTEGRITY)	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::ConvertSidToStringSidW ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::GetTokenInformation
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW ADVAPI32.dll::OpenProcessToken KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetDriveTypeW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineW KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetConsoleCtrlHandler KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::RemoveDirectoryW KERNEL32.dll::SetDllDirectoryW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample