MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b153cca3bac87165e94ba9851a895ee316e0b9876795c1216388715a01b45674. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


zgRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b153cca3bac87165e94ba9851a895ee316e0b9876795c1216388715a01b45674
SHA3-384 hash: ce14263306b6e4ddc74f4b0df6936e56f88e300cb054ba47e414bb1a16c04b7f5e8ac70c15a74a3990cd1be67540500e
SHA1 hash: 5b5067b3ac8fc0ff1efc40adb7b4aabbdeb32dcc
MD5 hash: 5daf0d24bc4e8ed167d9a1b11e862d23
humanhash: venus-nuts-ten-grey
File name:Documents.exe
Download: download sample
Signature zgRAT
Create hunting rule
File size:901'120 bytes
First seen:2023-03-22 09:38:13 UTC
Last seen:2023-03-29 06:45:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:b6wuUNFqjZpKGUr6cnbAk6tVYgHPhiedTtvonvbq1cXln57j9ZbFGmOAiHGd:8tjZMfNbA3LYeM+TtvoDqOXFF3b
Threatray 2'441 similar samples on MalwareBazaar
TLSH T19815F15D7251F6AFC41BDD76C9982C20A761B16B431BE347604315ED9E0EBEACF022E2
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b8b4dcecf2b4c6c8 (13 x AgentTesla, 4 x SnakeKeylogger, 3 x Formbook)
Reporter cocaman
Tags:exe Shipping zgRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
Documents.exe
Verdict:
Malicious activity
Analysis date:
2023-03-22 09:38:53 UTC
Tags:
formbook trojan stealer
Link:
https://app.any.run/tasks/9824b086-c554-475e-8726-3bfca0d8531f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/376413/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Creating a file
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/641accb8da1bbe29caf97b02/reports/d9b583ce-d42b-4224-9df1-9c9bad71c9d4/overview
Verdict:
Malicious
Labled as:
Barys.Generic
Link:
https://www.hybrid-analysis.com/sample/b153cca3bac87165e94ba9851a895ee316e0b9876795c1216388715a01b45674
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/16235cc6-4786-44c6-91b5-b633b692b85c
Result
Threat name:
FormBook, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1199196
Signature
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected FormBook
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 832097 Sample: Documents.exe Startdate: 22/03/2023 Architecture: WINDOWS Score: 100 47 www.traumlichtfotografie.com 2->47 49 traumlichtfotografie.com 2->49 57 Malicious sample detected (through community Yara rule) 2->57 59 Antivirus detection for URL or domain 2->59 61 Antivirus / Scanner detection for submitted sample 2->61 63 6 other signatures 2->63 9 Documents.exe 7 2->9         started        13 dnnjWYmF.exe 5 2->13         started        signatures3 process4 file5 39 C:\Users\user\AppData\Roaming\dnnjWYmF.exe, PE32 9->39 dropped 41 C:\Users\...\dnnjWYmF.exe:Zone.Identifier, ASCII 9->41 dropped 43 C:\Users\user\AppData\Local\...\tmpF8A6.tmp, XML 9->43 dropped 45 C:\Users\user\AppData\...\Documents.exe.log, ASCII 9->45 dropped 73 Detected unpacking (changes PE section rights) 9->73 75 Detected unpacking (overwrites its own PE header) 9->75 77 Uses schtasks.exe or at.exe to add and modify task schedules 9->77 85 3 other signatures 9->85 15 RegSvcs.exe 9->15         started        18 powershell.exe 19 9->18         started        20 schtasks.exe 1 9->20         started        79 Antivirus detection for dropped file 13->79 81 Multi AV Scanner detection for dropped file 13->81 83 Machine Learning detection for dropped file 13->83 22 schtasks.exe 1 13->22         started        24 RegSvcs.exe 13->24         started        signatures6 process7 signatures8 91 Modifies the context of a thread in another process (thread injection) 15->91 93 Maps a DLL or memory area into another process 15->93 95 Sample uses process hollowing technique 15->95 97 Queues an APC in another process (thread injection) 15->97 26 explorer.exe 3 1 15->26 injected 30 conhost.exe 18->30         started        32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        process9 dnsIp10 51 www.42230.org.wcdnga.com 163.171.128.148, 49713, 49714, 80 QUANTILNETWORKSUS European Union 26->51 53 matrukrupacc.com 216.10.248.111, 49699, 80 PUBLIC-DOMAIN-REGISTRYUS India 26->53 55 10 other IPs or domains 26->55 87 System process connects to network (likely due to code injection or exploit) 26->87 89 Uses netsh to modify the Windows network and firewall settings 26->89 36 netsh.exe 13 26->36         started        signatures11 process12 signatures13 65 Tries to steal Mail credentials (via file / registry access) 36->65 67 Tries to harvest and steal browser information (history, passwords, etc) 36->67 69 Modifies the context of a thread in another process (thread injection) 36->69 71 Maps a DLL or memory area into another process 36->71
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b153cca3bac87165e94ba9851a895ee316e0b9876795c1216388715a01b45674/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-03-22 09:38:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wfj4zi52zbywl2klvgcrvck64mlobomhm6k4cildrbyvuanukz2a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
07843e27993206a92d9e0bfbb249332fcfedad068bec8f7f7f3f318654c7910c
zgRAT
13c4ed220256fb2dfb95631c042d9eadf977bd2dc5e4aa0898ab99bd16d33ef7
zgRAT
375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c
zgRAT
7fd5172067f790c21d11dc37987f04bbe9e4c04038074b788ac79bcc83c06f1a
zgRAT
ac61c80f02e15eb3705836ff8dc9d81543eb0e26059d4aaa9b0895c716deafe4
zgRAT
d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d
zgRAT
+ 2'431 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230322-lmma6aga68/
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Unpacked files
SH256 hash:
ef3c7bf77e06f90c5fee8f82de30d15cde347504601a2f4a4da5c808fda3d146
MD5 hash:
d721abd1774d5d25c516645d1613380b
SHA1 hash:
1d6ea57141f658bfbcbfa9f30cff02639897a9bd
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/eabc1250-6663-436d-b312-08472708472f/
Parent samples :
7fd5172067f790c21d11dc37987f04bbe9e4c04038074b788ac79bcc83c06f1a
375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c
d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d
e92f7d954c97723d975ffb5d04438494d692c6bd3b552a24d826e13ae6252ef4
aa5548a9ee7fbe66cbff5c8488bd260ee5377818faac895fecf519fc0bdf453b
ac8157f89fe4d01eb6e009147f4e6a3b64ebd924af77f4c4999b7dba22b53e4d
13c4ed220256fb2dfb95631c042d9eadf977bd2dc5e4aa0898ab99bd16d33ef7
07ea5734d5a27eec2e18629559643c25f87676c8f81f9abe12aebf742dead0d1
07843e27993206a92d9e0bfbb249332fcfedad068bec8f7f7f3f318654c7910c
ae2e5e556f6fab620a62ed8dfe072e73ebff0a207177e48cb3b65253055205d4
ac61c80f02e15eb3705836ff8dc9d81543eb0e26059d4aaa9b0895c716deafe4
b153cca3bac87165e94ba9851a895ee316e0b9876795c1216388715a01b45674
179b98e2cb16a094755f853ae892b47948a8b6a83e7ca050d520e113ff180b2f
1bf1d7519eb3538201392d2bc32be1ebf4e2cd720d637bc94a67d0765f6a645a
fe7957318166dd7147d4b7b42360f9369f0657308fa68f929d573d4ac99aed9d
40d4375902fce141fe2e90e675790acb6b8f3d98fb2a53a90aa18cbd629a51ef
SH256 hash:
c5f46eae4c3daf89f723d9a0ed54928319b429e8e6b7e090b6d9887a7f8ef56a
MD5 hash:
efb0011b5da4e019d914f3c0ab18f002
SHA1 hash:
0be02538e44f1a12f5b61d90c94f9bd20c562813
Link:
https://www.unpac.me/results/eabc1250-6663-436d-b312-08472708472f/
SH256 hash:
76648be8f3318ecebb45047ed9f5c9d13507b6ce899e63a890d24da532e76c7c
MD5 hash:
d205ab8d03e94b243ead32b58f0bc017
SHA1 hash:
def3305cdaabede584e2e8992c1f7398e4bdee23
Link:
https://www.unpac.me/results/eabc1250-6663-436d-b312-08472708472f/
SH256 hash:
27412fdef939e79af0c7394f8ecc8f70999262a510e8ababe42b5adff4959f0a
MD5 hash:
46b0f8c548013dcc6e168048e963f1e8
SHA1 hash:
810c93b5a6849ab5a29ded0b3ccc49499e05fadb
Link:
https://www.unpac.me/results/eabc1250-6663-436d-b312-08472708472f/
SH256 hash:
8617cea503c2a3961120a9c503d853bc21d38d1fca7143d6b1ef4f388bc5cec7
MD5 hash:
7f225c69df031bf0560aed3847a1221a
SHA1 hash:
4d5f3ccdb2c6015d2b2a73326c0f32b173af2819
Link:
https://www.unpac.me/results/eabc1250-6663-436d-b312-08472708472f/
SH256 hash:
06007bf027b46c2124aae4fc66e38441a2b1cdcc0d18b5341f9b9860bc3c8e66
MD5 hash:
98b1bc4ca584a9102aa42a68bce8a575
SHA1 hash:
1a644c2bb1e2292c78e9cb663a17b636dcaa7bdf
Link:
https://www.unpac.me/results/eabc1250-6663-436d-b312-08472708472f/
SH256 hash:
b153cca3bac87165e94ba9851a895ee316e0b9876795c1216388715a01b45674
MD5 hash:
5daf0d24bc4e8ed167d9a1b11e862d23
SHA1 hash:
5b5067b3ac8fc0ff1efc40adb7b4aabbdeb32dcc
Link:
https://www.unpac.me/results/eabc1250-6663-436d-b312-08472708472f/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b153cca3bac8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_zgRAT
Create hunting rule
Author:ditekSHen
Description:Detects zgRAT
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zgRAT

rar fd69359a2620691c4409432dae20bcc957c9ba1f69f824b6eb36c3f5cd052d98

zgRAT

Executable exe b153cca3bac87165e94ba9851a895ee316e0b9876795c1216388715a01b45674

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 fd69359a2620691c4409432dae20bcc957c9ba1f69f824b6eb36c3f5cd052d98
Cape
Cape
https://www.capesandbox.com/analysis/376413/
  
Dropped by
MD5 d1b89485286a6c6d69bfdd84f2a28533

Comments