MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f943cf382d0c97c65b9ab3402d85118ee810127b648eb9fcc07c3f3404b281ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


zgRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f943cf382d0c97c65b9ab3402d85118ee810127b648eb9fcc07c3f3404b281ae
SHA3-384 hash: 3a9e7923f466ceb0f6d10fbabf96ee68e7355accdc5c91b26a479e33b7df3a72ced52a285224a75887fa362506bdea3a
SHA1 hash: 131a528848ea080ae60bb89d0780bfadf69a1420
MD5 hash: 41c3a1be867a689a3c4c2e95e2c40023
humanhash: eleven-angel-emma-cup
File name:SecuriteInfo.com.Trojan.MSIL.Crypt.15898.116
Download: download sample
Signature zgRAT
Create hunting rule
File size:1'459'712 bytes
First seen:2023-11-12 07:23:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 24576:GJ4y0qCUCJAqsKDON5XpGA7xGcTU1/dhF+dNdVzQz+2PU1zbM160ScVbcIAt:GJ4Uqsx9pGA7xGUkjF+dPV8+PzgjScVO
Threatray 276 similar samples on MalwareBazaar
TLSH T1BB65E0A8179C875ED67E62F5F1951806F6B4C047D1F7EB8AEDD0A5F06E833908A030A7
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
Reporter SecuriteInfoCom
Tags:exe zgRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
300
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.MSIL.Crypt.15898.116
Verdict:
Malicious activity
Analysis date:
2023-11-12 07:24:08 UTC
Tags:
zgrat
Link:
https://app.any.run/tasks/a9fe3135-9c3d-465f-b7da-8048db2e0e26

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Crypt.15898.116.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Restart of the analyzed sample
Creating a file
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Launching a process
Using the Windows Management Instrumentation requests
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/65507d932546bd423f16fba7/reports/be908eee-a16a-4bf2-a53f-10f7037c3add/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/f943cf382d0c97c65b9ab3402d85118ee810127b648eb9fcc07c3f3404b281ae
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d29779d6-a13b-4904-8a6a-8262e4cc6083
Result
Threat name:
zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1341240
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected PersistenceViaHiddenTask
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1341240 Sample: SecuriteInfo.com.Trojan.MSI... Startdate: 12/11/2023 Architecture: WINDOWS Score: 100 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected zgRAT 2->39 41 4 other signatures 2->41 8 TypeId.exe 3 2->8         started        11 SecuriteInfo.com.Trojan.MSIL.Crypt.15898.116.exe 3 2->11         started        13 TypeId.exe 2->13         started        process3 signatures4 49 Multi AV Scanner detection for dropped file 8->49 51 Machine Learning detection for dropped file 8->51 53 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->53 15 TypeId.exe 2 8->15         started        55 Modifies the context of a thread in another process (thread injection) 11->55 57 Injects a PE file into a foreign processes 11->57 18 SecuriteInfo.com.Trojan.MSIL.Crypt.15898.116.exe 5 11->18         started        21 TypeId.exe 13->21         started        process5 file6 59 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 15->59 61 Writes to foreign memory regions 15->61 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Injects a PE file into a foreign processes 15->65 23 RegAsm.exe 3 15->23         started        29 C:\Users\user\AppData\Roaming\...\TypeId.exe, PE32+ 18->29 dropped signatures7 process8 signatures9 43 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 23->43 45 Modifies the context of a thread in another process (thread injection) 23->45 47 Injects a PE file into a foreign processes 23->47 26 RegAsm.exe 15 2 23->26         started        process10 dnsIp11 31 185.17.0.22, 39001, 49729, 49731 SUPERSERVERSDATACENTERRU Russian Federation 26->31 33 45.15.159.88, 80 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 26->33
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f943cf382d0c97c65b9ab3402d85118ee810127b648eb9fcc07c3f3404b281ae
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f943cf382d0c97c65b9ab3402d85118ee810127b648eb9fcc07c3f3404b281ae/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-11-12 07:24:06 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
1
AV detection:
10 of 24 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7fb46obnbsl4mw42wnac3birr3ubaet3mshlt7gapq7tibfsqgxa._file
Verdict:
malicious
Similar samples:
013910858eb170b1a636353c8a49230f53dc9fbeac783958b99ef5adf944db81
zgRAT
14ed823d0f5b4a6074fd3e70646505cda2918d403a6b2fd9e5b0705f933e5f08
zgRAT
5a1cb4b73917ff451c7c30ac38de585d93649faafe963fe60f601d618e2db505
zgRAT
e844192fb4c52758db729e18e8898fe0921bdbe1e2d3ac3da6a6b5d2cedecb71
zgRAT
f943cf382d0c97c65b9ab3402d85118ee810127b648eb9fcc07c3f3404b281ae
zgRAT
+ 266 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:zgrat rat
Link:
https://tria.ge/reports/231112-h8c3tsdg82/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
f943cf382d0c97c65b9ab3402d85118ee810127b648eb9fcc07c3f3404b281ae
MD5 hash:
41c3a1be867a689a3c4c2e95e2c40023
SHA1 hash:
131a528848ea080ae60bb89d0780bfadf69a1420
Link:
https://www.unpac.me/results/65c0b72c-b23a-49f6-8b9d-4e0e47a7fd7a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f943cf382d0c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f943cf382d0c97c65b9ab3402d85118ee810127b648eb9fcc07c3f3404b281ae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments