MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed04d8ebbc30c39278f1e22d2442853ff704f97f0e494d069034dee2239bc43a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


N-W0rm


Vendor detections: 14


Intelligence 14 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed04d8ebbc30c39278f1e22d2442853ff704f97f0e494d069034dee2239bc43a
SHA3-384 hash: da3c01dd109b0ce9ac6745aac1b4c6ff3ca2510180c5f918909268f55376072538c8734d2926333dc359113f7f441731
SHA1 hash: d450038a5712de118dafbf02e7ad267da0a026a6
MD5 hash: 293be67590ab7cec24b79c7a89919490
humanhash: april-nevada-lima-thirteen
File name:293BE67590AB7CEC24B79C7A89919490.exe
Download: download sample
Signature N-W0rm
Create hunting rule
File size:923'648 bytes
First seen:2023-12-01 18:10:24 UTC
Last seen:2023-12-01 19:19:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:zbk1BL9d48wCQ6QkJ1oYwo9BLmS3K49M/RPP7+S01te4wOE1Aox4aKvOZYc2S69+:47xw6Jfovkt3+RPySH1Aox4dGYjMbU/
Threatray 1'341 similar samples on MalwareBazaar
TLSH T1A615231442C55FE0E4EC8DFF9C83AF5043B48B61E663E7868498A475CC1ABCF685A45F
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe N-W0rm


Avatar
abuse_ch
N-W0rm C2:
5.188.159.44:58001

Intelligence

File Origin
# of uploads :
2
# of downloads :
302
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
293BE67590AB7CEC24B79C7A89919490.exe
Verdict:
Malicious activity
Analysis date:
2023-12-01 18:11:14 UTC
Tags:
purecrypter pureloader loader
Link:
https://app.any.run/tasks/5198557b-1cfb-4204-9677-c66c6a4de758

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/461756/
Detection(s):
SecuriteInfo.com.Variant.Barys.20010.20963.23169.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Enabling autorun by creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ed04d8ebbc30c39278f1e22d2442853ff704f97f0e494d069034dee2239bc43a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
MassLogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/873ad66c-1635-45c4-962f-193cf73a6da5
Result
Threat name:
zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1351606
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ed04d8ebbc30c39278f1e22d2442853ff704f97f0e494d069034dee2239bc43a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed04d8ebbc30c39278f1e22d2442853ff704f97f0e494d069034dee2239bc43a/
Threat name:
Win32.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2023-11-28 18:56:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
18 of 23 (78.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ucnr254gdbze6hr4iwsiqufh73qj6l7bzeu2buqgtpoei43yq5a._file
Verdict:
malicious
Similar samples:
5037733d3123c797e4c67a9c4d6aa45d99486f45afb64bc52979c142defa23b3
N-W0rm
87e8d20c870fe87533ab89f6cdbaeaab2efc2151884cda3d3a3f72080765055d
N-W0rm
8e684d3f9529b34396c708fafca492a2333d50222042c3a5f8b7fb0573c96251
N-W0rm
a481b300f1cf5ec873245d16c0e0fdfc18f681cf2ee682b23d47dd0b122c4998
N-W0rm
ba4d461d394b8345604518df33c0d7b09c2278c9fdf2dd747c28047d0c35cfe8
N-W0rm
ed04d8ebbc30c39278f1e22d2442853ff704f97f0e494d069034dee2239bc43a
N-W0rm
ff0179442402fa306c85ba83a87df2cc46d13012a1e2819e73a6b3586c5c8dc3
N-W0rm
+ 1'331 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:zgrat rat
Link:
https://tria.ge/reports/231201-wsk1dsef71/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Suspicious use of SetThreadContext
Executes dropped EXE
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
aee2ba7b7035b49b241bd0b596caac19ea338464d0a4dc24751b60054b4bbbb6
MD5 hash:
4bccce4b21bb4710f4d2facbd0d68a59
SHA1 hash:
fbedf4f4836e9ebbbd6bc9882dd994d422c4ac41
Link:
https://www.unpac.me/results/39bb1c70-2657-40dd-aeea-1989df6c6ab3/
SH256 hash:
2aa5523fadb20a788e86c42bc710a20a3b6f7e5d2924e88f4edff2eee9ae95f7
MD5 hash:
01064f36c17cf6dd211f1831426d89b2
SHA1 hash:
88f883684164749fb3c6df9cbf3273f51552b692
Link:
https://www.unpac.me/results/39bb1c70-2657-40dd-aeea-1989df6c6ab3/
SH256 hash:
3c9aeaf1540d275d4327e00e45dd5abcd8dd3470d8129c2a4e0965dc5480b1bb
MD5 hash:
03cf2ef246f62d4ff14c3a45bec86e6a
SHA1 hash:
78d27b44c350fe181437507311c4160ec74a71ae
Link:
https://www.unpac.me/results/39bb1c70-2657-40dd-aeea-1989df6c6ab3/
SH256 hash:
3d7c08e6749b877f82b93742661e0ca01b7fa09546866b422061f70ef54f7974
MD5 hash:
a09408d2eaa21839ce682c0d6b2df99c
SHA1 hash:
165e4e357bb4f8981fafce02f2834103a794bfa7
Link:
https://www.unpac.me/results/39bb1c70-2657-40dd-aeea-1989df6c6ab3/
SH256 hash:
ecf32eee37179b17d9d1bc0ca9ae49c82f4d71c2bc4b4b725bc307db5d77b7d6
MD5 hash:
96350672a46f86004782bcc7d82883be
SHA1 hash:
c62ab680e6af587f88b4bb6ac3b40b6b1e4245ab
Link:
https://www.unpac.me/results/39bb1c70-2657-40dd-aeea-1989df6c6ab3/
SH256 hash:
a49e47b1902287e5bc4c7b27134ba0e8a9d81a78a5109f55e74400ccd2b3a1ab
MD5 hash:
2780cab4d838a9278bf8baafd810bf43
SHA1 hash:
86e7c5c0e688b401f0af5e6e219191c161c5e3cc
Link:
https://www.unpac.me/results/39bb1c70-2657-40dd-aeea-1989df6c6ab3/
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
Link:
https://www.unpac.me/results/39bb1c70-2657-40dd-aeea-1989df6c6ab3/
SH256 hash:
173af5706970214c2106791f4e00d6e78a771eb1ab8dbf5d9b81e531f4cd22ee
MD5 hash:
c319302263a12b2b74c29494cf6f2c30
SHA1 hash:
3488b4781003e02aa3fbdb33673867d44ac595f3
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/39bb1c70-2657-40dd-aeea-1989df6c6ab3/
SH256 hash:
ed04d8ebbc30c39278f1e22d2442853ff704f97f0e494d069034dee2239bc43a
MD5 hash:
293be67590ab7cec24b79c7a89919490
SHA1 hash:
d450038a5712de118dafbf02e7ad267da0a026a6
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/39bb1c70-2657-40dd-aeea-1989df6c6ab3/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ed04d8ebbc30/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ed04d8ebbc30c39278f1e22d2442853ff704f97f0e494d069034dee2239bc43a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/461756/

Comments