MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b184755ffe990f3f5ab51c4d7b2bc1e4ec8f1839a4b9187dad2167c585018a37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


zgRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b184755ffe990f3f5ab51c4d7b2bc1e4ec8f1839a4b9187dad2167c585018a37
SHA3-384 hash: d8ce324c9f0c08b367370892fd9babbdd5b006f507b9f8758ad3fab8d6e531e4d1d395306b1775ce0d34180469065dcc
SHA1 hash: 887b9b4f1e7d1c617899b80a5e4d8363b4a2a759
MD5 hash: b9fb7a66fab4a809ed89d69dcedd3fac
humanhash: fix-snake-edward-blossom
File name:Halkbank_Ekstre_017368708270922_576389992082922.exe
Download: download sample
Signature zgRAT
Create hunting rule
File size:709'632 bytes
First seen:2023-08-24 09:44:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:9dfSRtH2lq3PahZ6DWVr4cghjC3tytZE6GYiRg6eybP5sK:9C2lq3yuDmmjC3t7Jq6em5sK
Threatray 1'247 similar samples on MalwareBazaar
TLSH T10BE402137A16AF7EC13787F67C2490124B72ED1E6681E35A8E8A71F65C32B024479E1F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:exe geo Halkbank RAT TUR zgRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
286
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Halkbank_Ekstre_017368708270922_576389992082922.exe
Verdict:
Suspicious activity
Analysis date:
2023-08-24 09:52:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5d262685-a5cd-4c14-a816-87429364a15e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/444450/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b184755ffe990f3f5ab51c4d7b2bc1e4ec8f1839a4b9187dad2167c585018a37
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6a1f680d-0329-46ec-a613-7bc0c95608d7
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1296543
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1296543 Sample: Halkbank_Ekstre_01736870827... Startdate: 24/08/2023 Architecture: WINDOWS Score: 100 52 Snort IDS alert for network traffic 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 Antivirus detection for URL or domain 2->56 58 6 other signatures 2->58 9 wQkhOgIciFa.exe 5 2->9         started        12 Halkbank_Ekstre_017368708270922_576389992082922.exe 7 2->12         started        process3 file4 70 Multi AV Scanner detection for dropped file 9->70 15 wQkhOgIciFa.exe 9->15         started        18 schtasks.exe 1 9->18         started        44 C:\Users\user\AppData\...\wQkhOgIciFa.exe, PE32 12->44 dropped 46 C:\Users\user\AppData\Local\...\tmpD7D9.tmp, XML 12->46 dropped 72 Uses schtasks.exe or at.exe to add and modify task schedules 12->72 74 Adds a directory exclusion to Windows Defender 12->74 20 powershell.exe 21 12->20         started        22 schtasks.exe 1 12->22         started        24 Halkbank_Ekstre_017368708270922_576389992082922.exe 12->24         started        signatures5 process6 signatures7 78 Maps a DLL or memory area into another process 15->78 80 Queues an APC in another process (thread injection) 15->80 26 OZVRJfGYxcc.exe 15->26 injected 29 conhost.exe 18->29         started        31 conhost.exe 20->31         started        33 conhost.exe 22->33         started        process8 signatures9 76 Maps a DLL or memory area into another process 26->76 35 msdt.exe 13 26->35         started        process10 signatures11 60 Tries to steal Mail credentials (via file / registry access) 35->60 62 Tries to harvest and steal browser information (history, passwords, etc) 35->62 64 Modifies the context of a thread in another process (thread injection) 35->64 66 Maps a DLL or memory area into another process 35->66 38 explorer.exe 1 35->38 injected 42 OZVRJfGYxcc.exe 35->42 injected process12 dnsIp13 48 www.ningbi.top 107.148.17.159, 49736, 49737, 49738 PEGTECHINCUS United States 38->48 50 www.adsshine.com 188.114.97.7, 49735, 80 CLOUDFLARENETUS European Union 38->50 68 System process connects to network (likely due to code injection or exploit) 38->68 signatures14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b184755ffe990f3f5ab51c4d7b2bc1e4ec8f1839a4b9187dad2167c585018a37/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2023-08-24 09:45:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wgchkx76teht6wvvdrgxwk6b4twi6gbzus4rq7nneft4lbibri3q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
14ae647473cbf4def9becdbbb1f007fd8c96c63be5c88014415ab13e6467168f
zgRAT
151fb5746b08b95408b92e08f4bbeac8c4a1a3fc3ad6f43d237357f10476b33f
zgRAT
68ecb3a0784bbfd4ac9f3d1c76cfc09cff02b4298839e2e1b293e9ef8833b265
zgRAT
79e1fc85396ae65e8431f8ceb92fefb5ec396381840d830c415ea2d81cb78a49
zgRAT
959fc8883e6b1d4ab77f9738792435e2dae1969530f36d2672db6cb397778687
zgRAT
96c459f3f71ca66620515448f8dfa12c67d8b3e020776c93ccda641cce782ad6
zgRAT
9c3860c6744d8b2718e1109e327795014997a81b0e21706a96242d0f8d52f55b
zgRAT
a1662b8e9f60ae12d014dc7bf567d136abef56c45d76b65c765c71d411c7ee8f
zgRAT
d0294bc11b1c8e0655189aba2ade4ffb54da6f36e2afc2ef2e0045a5a17203bf
zgRAT
ef66ea0bcee19ccd3d2771a170ff218a3e43b27f1b18f24e08685cb4d3fe053a
zgRAT
+ 1'237 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230824-lq26sabe85/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
b4ca3a7af2137e6471f822cf7ae765db8716890ee8212a56f7dc65689f281687
MD5 hash:
e43b1bf572e4125421be77bbb578e0e6
SHA1 hash:
67965b1a6f8e38daa37f6b26245b426fdf2cfc16
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/3e77f9af-038c-406a-943e-2e9e93f18d87/
Parent samples :
71f17fcf7ab7d74c32f6a1ed20f4315805847ebc6402b808ffe3fd42d0950cb5
f9c4add410b55fb7a5b176a3f71761bbdc6b138f6e7a2f1e39f8ee094dd3b992
b184755ffe990f3f5ab51c4d7b2bc1e4ec8f1839a4b9187dad2167c585018a37
SH256 hash:
9d231f4a38669cd88c9122ec387b1ea01e5c151a4d4b5df7d2167c2ee5a9ae89
MD5 hash:
88952f66fd4eeac38eff4aa5ee775c21
SHA1 hash:
d18306823c3be272b6eaa262222d3637f724d229
Link:
https://www.unpac.me/results/3e77f9af-038c-406a-943e-2e9e93f18d87/
SH256 hash:
96adc58eaea0c486e7ebfdab0430ab82ad12f1405b5b6a542c8cabb43e7e4043
MD5 hash:
e658b48ef5fd62ada111f48aaf0fbbe2
SHA1 hash:
f424f2632e8eb879d7adf82f1061d1cb30b4a7a7
Link:
https://www.unpac.me/results/3e77f9af-038c-406a-943e-2e9e93f18d87/
SH256 hash:
2ac2f55e15fd8da559f99925ceee9166ca978e94cbc53a5cb29bf02d0a76ac7f
MD5 hash:
1081db0b25581c7958e6fbff4d9aa64a
SHA1 hash:
bcb0e0fe844884a5b0d05cd3b0cc5fd7a5ff53b9
Link:
https://www.unpac.me/results/3e77f9af-038c-406a-943e-2e9e93f18d87/
SH256 hash:
6b959869f767cbed167d5169ef0f2375ea56e202a0a8ac8dbb8f05cd1eae661e
MD5 hash:
e845de7a4cd00244a0f9446be285469b
SHA1 hash:
9749766f00920445091f6b27306bf09be01c0ae5
Link:
https://www.unpac.me/results/3e77f9af-038c-406a-943e-2e9e93f18d87/
SH256 hash:
b184755ffe990f3f5ab51c4d7b2bc1e4ec8f1839a4b9187dad2167c585018a37
MD5 hash:
b9fb7a66fab4a809ed89d69dcedd3fac
SHA1 hash:
887b9b4f1e7d1c617899b80a5e4d8363b4a2a759
Link:
https://www.unpac.me/results/3e77f9af-038c-406a-943e-2e9e93f18d87/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b184755ffe990f3f5ab51c4d7b2bc1e4ec8f1839a4b9187dad2167c585018a37

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zgRAT

Executable exe b184755ffe990f3f5ab51c4d7b2bc1e4ec8f1839a4b9187dad2167c585018a37

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/444450/

Comments