MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fc264d3ffc563ee44ae41f7693c1ec08d3d57e19b69b6e59c0a300c7317135c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


zgRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 17 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6fc264d3ffc563ee44ae41f7693c1ec08d3d57e19b69b6e59c0a300c7317135c
SHA3-384 hash: bf262f8f3d03a29a742ee9a0dfe1790ae937a08ce1a753ad6776859d8fb08caa07084020497012c2dc1bea54aaf9fe73
SHA1 hash: 7e3e065d69e1217ac0a795989464e8c1266f9224
MD5 hash: 013dd34c1d52ad6a86419657437e247a
humanhash: pasta-sweet-oregon-maine
File name:013dd34c1d52ad6a86419657437e247a
Download: download sample
Signature zgRAT
Create hunting rule
File size:6'118'288 bytes
First seen:2024-01-12 14:10:08 UTC
Last seen:2024-01-12 15:17:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 49152:dc7zDiiSwc9hNVVRa79rosQe/POjXVdDyLdTE+mhTjx71YDKbHMGNuBeE:dwDPSwcZVVRiREbUFHmhZ1uG49
TLSH T178567C02BB99DA12C0592737D1D7591843F5D986A323E74F36C633A91A037FF4C8A68B
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f8ccdcc4dcccc4c4 (1 x zgRAT)
Reporter zbetcheckin
Tags:32 exe zgRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
313
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
zgRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/470546/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1959.12596.26598.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %temp% directory
Launching a process
Creating a file
DNS request
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
hook lolbin overlay packed regsvcs
Link:
https://www.filescan.io/uploads/65a1488294d1aebfb29b8357/reports/f66d1b5e-0956-40ad-b261-63ef242ca870/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/6fc264d3ffc563ee44ae41f7693c1ec08d3d57e19b69b6e59c0a300c7317135c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/037cfb4c-509b-49cf-bc69-d7edfdc3c20b
Result
Threat name:
zgRAT, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1373793
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
DLL side loading technique detected
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Searches for specific processes (likely to inject)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Vidar stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6fc264d3ffc563ee44ae41f7693c1ec08d3d57e19b69b6e59c0a300c7317135c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6fc264d3ffc563ee44ae41f7693c1ec08d3d57e19b69b6e59c0a300c7317135c/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n7bgju77yvr64rfoih3wspa6ycgt2v7btnu3nzm4biyay4yxcnoa._file
Verdict:
malicious
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:vidar family:zgrat rat stealer
Link:
https://tria.ge/reports/240112-rg9r6aabf4/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
.NET Reactor proctector
Loads dropped DLL
Detect Vidar Stealer
Detect ZGRat V1
Vidar
ZGRat
Unpacked files
SH256 hash:
63366bb58836a4d9fc6a7fb5632ce6aeb52fd2ec57ea5d766b27bfedf7b7deee
MD5 hash:
a6810a5899b5a89ee483c9e94dacb015
SHA1 hash:
c787d081f7534936636b17d94ecee651fd64fdac
Link:
https://www.unpac.me/results/55cfcea9-ddd5-4bef-b761-8f19ad41f5b5/
SH256 hash:
6a26df7ee49de6fec6c5de1f3f7a94075d2dfbc50922e3b30fd8111f2e734f33
MD5 hash:
f45c1512d5a47375e6e396b4d1111e58
SHA1 hash:
8af036b8c60d10e85cf82212930bb04bc0553f36
Link:
https://www.unpac.me/results/55cfcea9-ddd5-4bef-b761-8f19ad41f5b5/
SH256 hash:
4116117c9cb5079b703f513d7b4d98b426190cd938821cf52bbfabf7f4f5cbea
MD5 hash:
fe4ff853624eca5ccf904465e6437e22
SHA1 hash:
7fad9c8cc0d019575d7c24ce9698f6377920d092
Link:
https://www.unpac.me/results/55cfcea9-ddd5-4bef-b761-8f19ad41f5b5/
SH256 hash:
ebfa861d21af00ee36a2f752977a67a095412d1dd600fe26e5c01ab57601a0ac
MD5 hash:
2aec34750147233d0e6d01215516b2f2
SHA1 hash:
790c3818c722e5d8f1f692e74bf4c0533f209517
Detections:
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Link:
https://www.unpac.me/results/55cfcea9-ddd5-4bef-b761-8f19ad41f5b5/
Parent samples :
29f281cac20928673a516da70a1495cf217aea2dc386d7719de2df7c2053fb9d
6fc264d3ffc563ee44ae41f7693c1ec08d3d57e19b69b6e59c0a300c7317135c
SH256 hash:
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
MD5 hash:
544cd51a596619b78e9b54b70088307d
SHA1 hash:
4769ddd2dbc1dc44b758964ed0bd231b85880b65
Link:
https://www.unpac.me/results/55cfcea9-ddd5-4bef-b761-8f19ad41f5b5/
SH256 hash:
6fc264d3ffc563ee44ae41f7693c1ec08d3d57e19b69b6e59c0a300c7317135c
MD5 hash:
013dd34c1d52ad6a86419657437e247a
SHA1 hash:
7e3e065d69e1217ac0a795989464e8c1266f9224
Detections:
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
MALWARE_Win_zgRAT
Create hunting rule
Link:
https://www.unpac.me/results/55cfcea9-ddd5-4bef-b761-8f19ad41f5b5/
Malware family:
Vidar.A
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6fc264d3ffc5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6fc264d3ffc563ee44ae41f7693c1ec08d3d57e19b69b6e59c0a300c7317135c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Dlls
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:has_telegram_urls
Create hunting rule
Author:Aaron DeVera<aaron@backchannel.re>
Description:Detects Telegram URLs
Rule name:INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with unregistered version of .NET Reactor
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_zgRAT
Create hunting rule
Author:ditekSHen
Description:Detects zgRAT
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zgRAT

Executable exe 6fc264d3ffc563ee44ae41f7693c1ec08d3d57e19b69b6e59c0a300c7317135c

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2748334/
Cape
Cape
https://www.capesandbox.com/analysis/470546/

Comments


Avatar
zbet commented on 2024-01-12 14:10:09 UTC

url : hxxps://raymisluxtravel.gr/twoo.exe