MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48b87eb4ae33650b8eae8e4c3927d6e3e2b5e6f4e4fa7afd6b829992a395ca79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


zgRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48b87eb4ae33650b8eae8e4c3927d6e3e2b5e6f4e4fa7afd6b829992a395ca79
SHA3-384 hash: 1584be74556dcd0ffaba42a4eb38e550e95f3bfb5cbf25fef3cc8a101c3448a1744558fd94815df14ad25dda01b348c8
SHA1 hash: 2b02e2bb35997d38a370c2612679d672b70b839e
MD5 hash: 323396d6b689caff1378090a11a209ae
humanhash: sixteen-sixteen-tennis-island
File name:2.dll
Download: download sample
Signature zgRAT
Create hunting rule
File size:1'460'735 bytes
First seen:2022-05-05 07:33:23 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 12288:8CmhbYpSuIUfmI3YMFeAxTYVaFaUEJErVPxtzYO7YBS4dmz9JvizqaNjXxQ4PQQx:jYBDiWwWtlSFen5eiQptS0X5Q8
Threatray 674 similar samples on MalwareBazaar
TLSH T115653BC376A2AD62C109973BC4EA052947E2C6435693FB0FBD8913644C8B7FD4A4DD2B
TrID 83.7% (.DLL) Generic .NET DLL/Assembly (236632/4/32)
4.6% (.SCR) Windows screen saver (13101/52/3)
3.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter obfusor
Tags:dll injector zgRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Detection:
zgRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/268820/
Detection(s):
SecuriteInfo.com.Malware.AI.2114094658.24258.10909.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file
Searching for synchronization primitives
Launching a service
Searching for the window
DNS request
Sending a custom TCP request
Sending a UDP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated overlay packed
Link:
https://www.filescan.io/uploads/62737df718191645e0c665d6/reports/783e026e-64f7-41c8-851a-2a3de7ce8d9c/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
MassLogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1430db4d-d76b-44d5-aa14-09862bb34c3b
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/988333
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 620830 Sample: 2.dll Startdate: 05/05/2022 Architecture: WINDOWS Score: 56 34 Malicious sample detected (through community Yara rule) 2->34 36 Multi AV Scanner detection for submitted file 2->36 14 loaddll32.exe 1 2->14         started        process3 process4 16 cmd.exe 1 14->16         started        process5 18 rundll32.exe 16->18         started        process6 20 rundll32.exe 18->20         started        process7 22 rundll32.exe 20->22         started        process8 24 rundll32.exe 22->24         started        process9 26 rundll32.exe 24->26         started        process10 28 rundll32.exe 26->28         started        process11 30 rundll32.exe 28->30         started        process12 32 rundll32.exe 30->32         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48b87eb4ae33650b8eae8e4c3927d6e3e2b5e6f4e4fa7afd6b829992a395ca79/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-05-05 07:34:11 UTC
File Type:
PE (.Net Dll)
Extracted files:
3
AV detection:
10 of 42 (23.81%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
2a6a175d59e4c5c69eb490f20296a26ea53d59eb6580b3b34dfa1d2c4f717e76
zgRAT
6af08cff583e8520d50beb435bf93e133b4dea697fa65e12df39c134b67177bd
zgRAT
9c14d6ca77383fa5a3724feab17b217b900295abf77311a8c88f39ff7bb02f01
zgRAT
b206c2d164d66dcd9fad4cffdcb28d73eb64d2f663f1de6fb90cc10b47665c41
zgRAT
d3be2ee3efb4181dfeeb50d0a3aec292733ab22c39ee474dfd7f3f18780f1224
zgRAT
d952e6902baf966ee83e4036999827263a7132ca1dde7f4eab1797f9fbb75051
zgRAT
+ 664 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220505-jd44hafde3/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
48b87eb4ae33650b8eae8e4c3927d6e3e2b5e6f4e4fa7afd6b829992a395ca79
MD5 hash:
323396d6b689caff1378090a11a209ae
SHA1 hash:
2b02e2bb35997d38a370c2612679d672b70b839e
Link:
https://www.unpac.me/results/cb278c7a-0bda-48f8-a585-69ad32afd82c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/48b87eb4ae33650b8eae8e4c3927d6e3e2b5e6f4e4fa7afd6b829992a395ca79

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_zgRAT
Create hunting rule
Author:ditekSHen
Description:Detects zgRAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/268820/

Comments