MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7404e54f6f5eca18b5a8bcc5c542c898c46ccfc2f2c5c11951da86700a368c61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7404e54f6f5eca18b5a8bcc5c542c898c46ccfc2f2c5c11951da86700a368c61
SHA3-384 hash:	a60dd66a6990b05ff94660685a3714c0dc6a965fe07030ac496288a2e10593d5239b494077e536dbdd1207f23d427234
SHA1 hash:	c883cc4f5cc88b0a2b67efb8d8dccf756208fe71
MD5 hash:	24fc9fe4ac95bd3662708fffb53ea064
humanhash:	echo-princess-florida-paris
File name:	PAGO deposito.vbs
Download:	download sample
Signature	zgRAT Alert Create hunting rule
File size:	359'640 bytes
First seen:	2023-10-26 07:00:34 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	6144:qcLwlxduxETez8qNTB6SowlixiH48NTB9uTqgNwteyyyyyayyyyy1bfyyyyyJyyj:qcLwlxduxETez8qNTB6SowlixiH48NTI
Threatray	846 similar samples on MalwareBazaar
TLSH	T140741B1039EF604C72B77F521FE8B9E99E6FFB726A29906E2444030B4663D40CE91B75
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Reporter	abuse_ch
Tags:	vbs zgRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/456438/

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfuscated-KJ.32264.314.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/653a0eb334de31f579cb16af/reports/5006db68-4b4e-41a8-a47b-c6698e241379/overview

Hybrid Analysis Valyria

Verdict:

Malicious

Labled as:

Valyria

Link:

https://www.hybrid-analysis.com/sample/7404e54f6f5eca18b5a8bcc5c542c898c46ccfc2f2c5c11951da86700a368c61

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox AgentTesla, zgRAT

Result

Threat name:

AgentTesla, zgRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1332429

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell download and load assembly

Sigma detected: RegAsm connects to smtp port

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected Generic Downloader

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ASCII

Link:

https://malprob.io/report/7404e54f6f5eca18b5a8bcc5c542c898c46ccfc2f2c5c11951da86700a368c61

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7404e54f6f5eca18b5a8bcc5c542c898c46ccfc2f2c5c11951da86700a368c61/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Valyria

Threat name:

Script-WScript.Trojan.Valyria

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-20 20:27:36 UTC

File Type:

Text (VBS)

AV detection:

7 of 38 (18.42%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oqcokt3pl3fbrnnixtc4kqwitdcgzt6c6lc4cgkr3kdhacrwrrqq._file

Threatray malicious

Verdict:

malicious

Similar samples:

11e812da55ed18d2337cf3249cf00df14fd1442f1914dcd177eb36df329d3e2e

zgRAT

21445db597a3e5be3d011a54863eb7741a66261d190ea522c4c29156966a3939

zgRAT

279563c72fdcfa7fe078440f82764cd274f6885fe051b7c36557a0e8bbad55be

zgRAT

5dde21be9d6b2fffde1eeab3dd6fc370bf6c47f047d9dc7e16c5e9f0ead13b96

zgRAT

6c006e3c02417e43c43c66bf5e986a64b2bdced8cf62912e5d6e1de16ed90452

zgRAT

7b6ac52d00554670afbdaef1d7b26316cf9f9d4c8d162dfb4b0256077e13b3be

zgRAT

8b2ee20f8fb8df593ae00bf56f492d20106b64bd5388389df285f9af5fa9209e

zgRAT

d3ee013d6d3189698f86f7bf10bac7d49ae944d574e40f6f0888d702d52fcd18

zgRAT

dd4a6bb436e33a55b18f88a38f23ea82b1f4d80cb170eeb7e1de6797b9ce59dc

zgRAT

+ 836 additional samples on MalwareBazaar

Hatching Triage zgrat

Result

Malware family:

zgrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:zgrat rat

Link:

https://tria.ge/reports/231026-hs8jsseg4s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

Detect ZGRat V1

ZGRat

Malware Config

Dropper Extraction:

https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zgRAT

vbs 7404e54f6f5eca18b5a8bcc5c542c898c46ccfc2f2c5c11951da86700a368c61

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/456438/