MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f66e317ed473eefa183bd115409da21ae3a4c0a5ba63b71d8b71d78811293d1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


zgRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f66e317ed473eefa183bd115409da21ae3a4c0a5ba63b71d8b71d78811293d1a
SHA3-384 hash: 37dc436628198a1edcab113cc9f1350f34f4ea3240372506cd4ee8a003af89ba90457d8d7b58c8cae3b98f18ea66954d
SHA1 hash: a0e46aa6a7cb670dd7d7f69b0d467b432e267fed
MD5 hash: 4fade52bc24fbd95f4ce91c088f7badf
humanhash: indigo-mango-fruit-robert
File name:file
Download: download sample
Signature zgRAT
Create hunting rule
File size:7'659'008 bytes
First seen:2022-09-02 14:52:30 UTC
Last seen:2022-09-03 16:27:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 98304:eVhpkZoduG52loermUrbd5oJ8y78qRS/f5XFTwkqj6evniyHStfyywG2iP:eVXjsG52loMmcGYqRQF86evzSFwG2iP
TLSH T10B76AFF13A0BE2DFE3568478F441D947C06913E19BE4E541DC6A783C8A53DA621CABEC
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 1371f0d4cce87113 (1 x zgRAT, 1 x ArkeiStealer)
Reporter andretavare5
Tags:exe zgRAT


Avatar
andretavare5
Sample downloaded from http://62.204.41.123/installer.exe

Intelligence

File Origin
# of uploads :
13
# of downloads :
557
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-09-02 14:58:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ff0fa51b-a91d-44c8-ae10-e42d86d63d98

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/307485/
Detection(s):
SecuriteInfo.com.Dropper.Generic.VZR.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for analyzing tools
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the system32 subdirectories
Creating a file
Forced system process termination
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6312194ea47cbae3661e2edf/reports/075f439e-305c-4c3e-8fa6-9e551d9f50f9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eb6bbf63-1492-4c49-918e-46da428d6073
Result
Threat name:
AsyncRAT, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1064190
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected AsyncRAT
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f66e317ed473eefa183bd115409da21ae3a4c0a5ba63b71d8b71d78811293d1a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6zxdc7wuopxpugb32ekubhncdlr2jqffxjr3ohmlohlyqejjhuna._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:3108_ruzki evasion infostealer spyware themida trojan
Link:
https://tria.ge/reports/220902-r9ahrsffbj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks whether UAC is enabled
Checks BIOS information in registry
Checks computer location settings
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
RedLine
RedLine payload
Malware Config
C2 Extraction:
213.219.247.199:9452
Unpacked files
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/9077604d-1887-40b6-a842-43548d535eae/
SH256 hash:
5e1c9a62d7cee83c84777b3510e28936481c7b16062e5a869ad6b4c9be566076
MD5 hash:
061bab326bdd01661fb66a39c7ddcf3f
SHA1 hash:
42cef1e71a754e5887de2ba929d541d7d5367d68
Link:
https://www.unpac.me/results/9077604d-1887-40b6-a842-43548d535eae/
SH256 hash:
f66e317ed473eefa183bd115409da21ae3a4c0a5ba63b71d8b71d78811293d1a
MD5 hash:
4fade52bc24fbd95f4ce91c088f7badf
SHA1 hash:
a0e46aa6a7cb670dd7d7f69b0d467b432e267fed
Link:
https://www.unpac.me/results/9077604d-1887-40b6-a842-43548d535eae/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f66e317ed473/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f66e317ed473eefa183bd115409da21ae3a4c0a5ba63b71d8b71d78811293d1a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/307485/
  
URLhaus
https://urlhaus.abuse.ch/url/2286801/

Comments