MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c70c391c3da0b64bb0f82437b3ebe6b18efa3cf871c2d890820725a060474bf1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


zgRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c70c391c3da0b64bb0f82437b3ebe6b18efa3cf871c2d890820725a060474bf1
SHA3-384 hash: 3c5adb0fd59f0aa3889da946ecab3ebaf151a49e9c6ee30066cce0ee501f457bcaa4ae26ad2a6db3010c36bcc84749fc
SHA1 hash: aa3cfa16fa990e9135e74b04ad7182513a92fc26
MD5 hash: ff3965180d6b8696fe08a9eba56a1f10
humanhash: missouri-glucose-football-nitrogen
File name:SecuriteInfo.com.Win32.PWSX-gen.8421.25742
Download: download sample
Signature zgRAT
Create hunting rule
File size:633'344 bytes
First seen:2023-12-11 04:19:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:B3IU8S6eUdpcivZbnitNv2/vAefGigU5ri64WNtfSANEzf8DcDK5:ZItSAdpbni/u/vzQWNdhCNDK5
TLSH T1D6D41289E6A68B59EC7317FD24790D922BB2FCB99070C20E6DFC31EA69773105412B53
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 71d496b2a296dc71 (11 x zgRAT, 7 x AgentTesla, 3 x Formbook)
Reporter SecuriteInfoCom
Tags:exe zgRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
338
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/464933/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/65768df4855eb2633d665366/reports/632c540a-ae84-453c-975a-699014080c3a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/c70c391c3da0b64bb0f82437b3ebe6b18efa3cf871c2d890820725a060474bf1
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/149cbdb7-a172-428e-871c-1834ebb82351
Result
Threat name:
zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1358112
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c70c391c3da0b64bb0f82437b3ebe6b18efa3cf871c2d890820725a060474bf1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c70c391c3da0b64bb0f82437b3ebe6b18efa3cf871c2d890820725a060474bf1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-12-11 02:34:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
14 of 23 (60.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y4gdshb5uc3exmhyeq33h27gwghpuphyohbnreeca4s2aychjpyq._file
Verdict:
malicious
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:zgrat rat
Link:
https://tria.ge/reports/231211-ex4jvscgam/
Behaviour
Suspicious use of WriteProcessMemory
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5
MD5 hash:
579197d4f760148a9482d1ebde113259
SHA1 hash:
cf6924eb360c7e5a117323bebcb6ee02d2aec86d
Link:
https://www.unpac.me/results/128b6e99-5015-499c-bd7a-408e03ac1ff1/
SH256 hash:
06b7295d429c2647055e97be975589cb64591b1ac4ef95aced40d35d89abd006
MD5 hash:
8d7f0b8acdb970e0e23652f187762294
SHA1 hash:
a9949921427dfadd276abcdc1fa186ca08db867f
Link:
https://www.unpac.me/results/128b6e99-5015-499c-bd7a-408e03ac1ff1/
SH256 hash:
ac74b6323686a1559af60949f559ff4248b008b592f0a0bc8bc7bca56c5af51b
MD5 hash:
a040a3815da269207ec8617ef9659caa
SHA1 hash:
731f018aa62abc957a2e53fe9047ee3247b5d9f5
Detections:
MALWARE_Win_zgRAT
Create hunting rule
Link:
https://www.unpac.me/results/128b6e99-5015-499c-bd7a-408e03ac1ff1/
Parent samples :
6f13cda874c2c4679ecc9be84fb66cb7aeb0e41175257ff093f353206ee07a2a
c70c391c3da0b64bb0f82437b3ebe6b18efa3cf871c2d890820725a060474bf1
116471f0d1acaf2e16533a66e0f53eb4c281e5a58a20533724ee6eab2a355f8f
73748ac07ab22e04c4c950cac58d559e8fcceeb7b919fb6b933cd20201c29fce
b5deb3a04bc823e2177189360ba4b1cacaf393633d88512a338baccf2a8ac306
f850cc8baaa282f21dd826e56b17b9eed05fb28d0d5acabaa7ac22b42bf33a5f
64140612ad5497b44f9ec5b6b65013f817cd4db10171ee66e88a7ce721597b30
a321afdf7017aa7e545bbea6ff63ed34b98769f54baf61874d7d05a2671dd152
1c1ffe1a97f66ee3f36058ba41beda34fe52b2a4ff3e10dbf487d3ead8ca8432
3f479de77fd65ff82d89c44b941aedd81d9afe93093699e40ba82b02e058719a
bd8eb863926c72554215411e9b181419ddb5b4215ed739a153bc3dc5409f6b72
083488944d0efc342bbb4bdb7881822e14781b3888ea58d1f7121dea52933373
5a62ce1ce44bcaed2a0fddb1aadfa7bc0fcc3a63eadfc0016fb4038975bf4ebe
22fe993d3d069bbd257db91dd0bc76cffabc3a67ac535e0cadc7e58649f78f49
a50c08375ddd2954e1f0082afddecbe511c8cd55111471b34d9820f2874cdf04
e9f88073d5491f31b1adfaea06537b8601075e4cf5990a415248ae0508240126
eb2e77542e2aa39e9b1dab537b748205b21e2f97667d6d0f4705db08bbed0674
44b93183c3adf1687380f0c5dc8af00571fb0f882fef49f5d649ecc8149d98d3
cf07ccee4a997c438225cd4b3ca7f706fbc9be102e979da877390d3c9bf1d4ea
4a5c1ecaabfa1e8421a4a975593f1563f5170f538daa982ea2050e902bd7dd28
e6dae7830360bb68c07346c6d4d1a34fbad395f816f555ebac96c683adf12008
9c0346e08a28cec8ab5be231e650450bbf64ebc42a14169e755ed9badef3b630
ae86206a568d280d3e030ec9649148ff98b59c6e3cd25e78094cc53631b674d7
70a65c589b3b46ed049d952785c5f21d709c7b1558bce2b0646e54927a93da38
1ff764ec5a79ed2072a558af6de49b863e9e5683e63b3c070e86c9d1b7814f4d
41430a71d6847e8c25206b5101164baa53b098ca1ee9c8d71a33ceb09e672927
0368245b094c8052f505d99d1ced140ba11a1146febb512934b4bbd2a6820b4e
660196e4bd02b5121c4ff5ef3eb9713372d5d812ff74caac219f51b68a4d7262
8ba8416d095006be656b4b4e0eaa987cd84a5236641020ebaf22b0cdf08b24ef
a89ba38f7ceffe3e59803a0208dee82349f86c7d72aaec093f8ca310c5d20c9b
a6aecca7d8f0cf861ae32b0ce54822e1d3c82e94685861b130c842f602b9d7db
6fe2539dc4c6ada59a03070d58d4d7cdcdae0b9f5ef44be83d73f76bd534fd93
000dd50b2f3df84aa499e38e8a88994b92c14556c517cd26237eacede1130c3b
b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379
bdf5c86fd79318fbe9c3e2bbf9234fb5d3ea093047e0b290244659f9c08c9ebe
7f382cc5928a8adf09033a4412af83f103fe25384f7fb39343344432fc71f8c1
4ac078a48ff7d80ccbc37c526e395b51f900c8206afe29e27b2a84bd2cd84532
54c2f9f13b1dfcc142740e1839215c536f913a802681be17a38f47881057ebd9
392fd8412e2fb96a3a9c54cd0aa32cf6c3bea21432e1ee46690412580055c214
355dd2c151a8acc04968060f9a92ddfe6d35839b63cae0a5e4f275ed7b5af945
db43a9c81339b049a202446b1839d6bc2561f1e337de20848f3b3966bb121313
be5ea75b6b003e8d06764370ba6a89be22845dec6bcf25a6f2d50c2d478dd214
b4cbf684e8873e04a1ff54c62bdb9eb5782d1cea507edc3cef13ac280f049a2f
efc775c58c7eae3c979f2548bad92d3665733aad94ca3977562aad3c098d28c7
8c3df75077ed123924224935250b7ea35f29f38bee3f2e2fa40e3cbbd3d81a69
98ab9015ecdc96f72bf9002e753b766c1d5d2526e8b2b8a18899d1c91ad6e7b9
c331f95e895af34cdef56c25798f1e1fe8ab448af4267e2a26ac4e46290fc2dc
83027993477c55431189f73dfb877084df278ea4f14e8681b08550c699cc3f6e
28cae570f064be5296ab1494ac94ac33772fd78f411f1c73386795778e428ae9
5c3a1a44e8f69e87acc9b95aa6798fcecbc33dc8f11a96b89bea796236887f92
9824b822a689518c8db4e0c8ab997a7bd149c57618bdc7790d1dc121a2493a86
9f21f1f91edaa634509595d3a70956e4d6c140a00c8b3b4dc7941ad394185b6a
e3845082f1e4162bc8f91eadb13e63a07d7b985e7322144c0867f364157ea490
059f60cd43b55dc2cadcd89ea57b8b7c48ca2677e8dea439ac6a7d7b6d9593bb
SH256 hash:
23f0988a2516bbed0cc362a6d88b743bc07dc03c92c38ba4e2796cddbd28a9db
MD5 hash:
e23eedd13ea327d25bdebb8dcf8c12fc
SHA1 hash:
63c7b872a816e77e147d4ff5d5706bfa96205872
Detections:
AgentTeslaXorStringsNet
Create hunting rule
MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
Link:
https://www.unpac.me/results/128b6e99-5015-499c-bd7a-408e03ac1ff1/
Parent samples :
5d6eb27a75b5149750cb2891e26f18aa808f2cfe9dd633777028bbcbbce10105
333bc1da1ebac150e52df580ad487c35d31caa25bcdd8e06dd1579cd6dd86019
9e9271e281e82549c613d3aba4a0603536a63c960bf42c16302f6b7668de0d78
310cca45875cb77640bd15ff405af55de5a00828088722da1681aaa2cc90c931
e446bfc6a1d4e343f6840965abf9d010f5c32e06b188d3d076fd2e3e0b0bab79
c6e74929d1f5df0946833f77f1074f8a8518a642067b129dae1ad261ded796f2
bf97757e1e84e0b3c97e2df6f9262873ab853605d2859ca93852dcb6d24513a9
5726f0ac293bb3dd4a0fce6bd6e7f7d9ded4ecbed55733bab4c91be2e58be478
b9d37d2bd06ca6ea4cfc72d49f30ffab897351e19f4cd31464a2a3314ee642ba
067aca62f68ca0996bca1267c8fec3859a412a514db8878808bfd576359f5ee9
9ade1aaf821812d038b9bab451e0b48fad06c688e738a522e2d3d9947421209a
4581026ca8972214b08a22a0b621d607997da7586b828e02bfab11a5ca5de33f
4ea83aefa492b4ba2b49e13e34023674ed8b50373a9f521dc887178f60b60965
ea334a8065334c73ce7ab24aaf3aa8d2bf400bfcc1389b5859e76348191a43f5
27e36aeb932b11f7f1a9eb8f7cc2ff7cc7d05549d3936aaaf5a6566cfd72166f
256ea055c6552920ec84ce91c5e9caae6bf9ed5a262c1f237adf8be1a99e8272
40247a3716900e213541061e25967670cfaa9415f554228dd6766e93a0def8f5
9ff3cd3ff6bb45bd888b2eaeebef3aef2784182df2ef03449d435098166882ba
d3b064dd11c1c634020c0c155bf9e33c1f0ad2fd8fc85eb1ffd44e05cfd4c291
2bed887fca5ae34bb249eb750e20b7542c9209a169745ad2bd9176618042f8ee
30a2b97369cb49a104c48274ea39b1af4b3a1eb9f8ece684632ee00bc409daeb
6e41de3cfe2a499488f1eae60dc1ba0f35f0e86c2428271e78bc8ddb51e26d0c
af87ecc512fe3271689f7674ab31070633ac5a85b3a5b2ac585068f3127b77c7
427883d7c6eb502e12e7ae65c1d2c241c8815998faea9dcfd9681d8f40f1f665
f37444849fb5d3f512aa399c0ccc8bbac2dac9a725c7965f445cc472f64a727e
23f0988a2516bbed0cc362a6d88b743bc07dc03c92c38ba4e2796cddbd28a9db
4644d82860cef54c8cd84971e923baa8ddc0347375701c7dbf5a884bb1c5771c
5d0e819a624b53524558b2e89007e0a645123a0e401a4dd5c2e5f709730e8f0e
e1836520ed6edb7fe91462076fdba7e96174e4506e7fd2df69de260199e5c020
2685ea1f640c12172fb5e136a624f56fd904627b6523a75c7f9357c0313ec518
a8ee0501ce8a092cc0cdbbfd3572db5c3ad505e054ffc24e4af4b6678726f850
dd9072aa04107fc87a791671e749e9b8833fa7885271e392ee1db9fdd30ff7ef
5f38f51f0ecaf46523adab8c5597af29894278716ebee0e1a87bde9863424b88
0caa683c9f3f6bcad952386397eb6a3e70d5c0f4b2b3d8b144f03a620e81ef0f
4f20ef240b6cd77d44c9515a39f1f9a4f12cdd84a043fa63a9928fd8728e3106
c0fcad9ddeff65354abef66d0d0ff63091aa7a090e7b281514956367d9bcde40
fa77fd0bc332cc52417da2001bbfee518d2d6cb6c363d15e67d1417afe784325
1f3c7beff0c3f2e7f7c21ae2ad886224c71a739c7554ba8f38aa3f9019ec48db
9e7eaf53bfef161396377f312d623d10c49746779710206acbe408496e50d68e
01af6a15beb6d627c8e7d255eb0d8f2e1167d710b101973b8da9b50246368bf3
2c02305910d1d64b8128f8519f65a75a9d33a27cfc21de77bbd087fde9bef580
b723d813af59659cb9a6164a6b1e9e2ec42353ca05272cd3b773282e76fc2385
4f9ab5722f95d20fc30c81bf817157c48c6e3f6e53a5a2881ff846be338eb360
f6ceb475c843b5339bdd85afc176eba77bf0d7a133afa4e092e3cd9e93889a7a
4ffdc291532f5d4d2960372a807b3215c9486d6fb643d09c64fc2ecf23cb31d8
eca31a8b84856348ea97f1a1469c8b34f6afc80b79e5a0d40fca44f2a4139d0f
becf6b9764ef6665d04082b9f4879b9bb1fef8976d752411778b7d83fae74057
9de62e10117526b21be8cded286a1522be0237d4b6e24d51d5bef8cd66cf7eb4
47dfb65b3426e320eb7e9ba01ab8fe1e12bc00ffc217f148676638823978c350
4bd728557c59a4ab89a5d3bd881603e69fa41247bab33f22d95404e532b21b24
fcd1fb8ea7cf43f01388e7763017ff869ccd345ce8d4cebfd9b97dbd2496520f
ed3e5af47aca29408248c203ccc55369d5c8e1c7d468b613fd3993fdec39eb08
4b521275a1d1b0a5c527419333dddda642148dde8cefd4fb9a8e4657848844b3
d8c86642c4e7e86d3591143c9bd7a7ca0278ed8812908b81e5633948ebee2eee
ee87b91b6480592bf45354a624ef6b478ed812f5ef33e36dbb6775fe057dbcfa
b68d03062282d38f52d9c19540ec2e1ec85eb501fac42d5ac64c4f77b1e087c1
d7c1ff8739d0d26e441b0828edd8e77700a97d19231d1cf0dbb105735f793ef0
ac3f1194d74f5cc87908936d768285d75e7df2171b653271a59568399b0753de
2af7b3022340dcc9a68e42e7b6c429e12923b62f81a36bb59e61a6121fdf2052
1cbbef03f82222e64ba32d7834fc6d1718b5cdb7f2f9b90ccf7d0732a95615f6
e9f611aaae38af4a81b3dda7c5997a4c8e852b6b87f4462b70bf5b5fa016e584
c7d5597ac8ed4d56434f101e6fe02c9ef5482f36502fa5b4f764b52ea643a5da
c70c391c3da0b64bb0f82437b3ebe6b18efa3cf871c2d890820725a060474bf1
abd4a743c4aa8fb625f1af14edc51606fc1b8e1a15396d9db706c1fd3cf41395
73d86b4c5e0ec35d75e6d81fa0244f5320a267b34fa37b12f5d548958c9390f4
b95ca7569939cdab51f2d7f4b20e8d76cb94a08b26e38aaedf4d6d84faf7d12b
SH256 hash:
c70c391c3da0b64bb0f82437b3ebe6b18efa3cf871c2d890820725a060474bf1
MD5 hash:
ff3965180d6b8696fe08a9eba56a1f10
SHA1 hash:
aa3cfa16fa990e9135e74b04ad7182513a92fc26
Link:
https://www.unpac.me/results/128b6e99-5015-499c-bd7a-408e03ac1ff1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/c70c391c3da0b64bb0f82437b3ebe6b18efa3cf871c2d890820725a060474bf1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/464933/

Comments