MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68e272e40da3acbe763374b71fbbf375aaa1ead475ebedfebe699c5f18d2df9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

zgRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	68e272e40da3acbe763374b71fbbf375aaa1ead475ebedfebe699c5f18d2df9f
SHA3-384 hash:	5bbdfce401c6fb654f1bea76a3f3d81cb838b1fbcd75c4a892d4a7df18440ef637c943306e34bad36bc251fc41473a15
SHA1 hash:	7ac40785cc0743178cf9835af6ebbe509e4b6e67
MD5 hash:	27a9d1df485ef6104e9567911e420934
humanhash:	nuts-one-red-north
File name:	27a9d1df485ef6104e9567911e420934.exe
Download:	download sample
Signature	zgRAT Create hunting rule
File size:	2'329'088 bytes
First seen:	2022-10-06 09:33:12 UTC
Last seen:	2023-08-26 21:45:51 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	24576:lJ2oCmUBD74FYRr4mccN+BoCIFDnYQb6VOIMhFDId:
Threatray	1'217 similar samples on MalwareBazaar
TLSH	T1EBB58DF4E0AF04D1EC076EC06978BDD6473232B38ED50934377EBA044FA79B9990995A
TrID	63.5% (.EXE) Win64 Executable (generic) (10523/12/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Reporter	abuse_ch
Tags:	exe RAT zgRAT

Intelligence

File Origin

# of uploads :

# of downloads :

240

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/317214/

Detection(s):

SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Searching for the window

Creating a file in the %AppData% subdirectories

Creating a file

DNS request

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

Creating a file in the %AppData% directory

Creating a process from a recently created file

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/633ea10b5c60ccc9fcff5692/reports/4943ceeb-fdea-464b-a53f-7314836299f0/overview

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/6ab4ae37-a8af-46f2-b645-d7c0eb28d806

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1085243

Signature

.NET source code contains very large array initializations

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Costura Assembly Loader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/68e272e40da3acbe763374b71fbbf375aaa1ead475ebedfebe699c5f18d2df9f/

Threat name:

ByteCode-MSIL.Backdoor.DcRat

Status:

Malicious

First seen:

2022-10-06 09:34:10 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

18 of 26 (69.23%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ndrhfzanuowl45rtos3r7o7towvkd2wuoxv637v6ngof6ggs36pq._file

Verdict:

malicious

Label(s):

asyncrat

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence

Link:

https://tria.ge/reports/221006-ljtk3aghb7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Loads dropped DLL

Executes dropped EXE

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9a4e3d84-038f-4009-8027-3a4c1512a30e

Unpacked files

SH256 hash:

68e272e40da3acbe763374b71fbbf375aaa1ead475ebedfebe699c5f18d2df9f

MD5 hash:

27a9d1df485ef6104e9567911e420934

SHA1 hash:

7ac40785cc0743178cf9835af6ebbe509e4b6e67

Link:

https://www.unpac.me/results/43a426cc-7473-4558-8eea-82bc6642e04a/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/68e272e40da3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Backdoor

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/68e272e40da3acbe763374b71fbbf375aaa1ead475ebedfebe699c5f18d2df9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.