MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f976cfadb68d079d3190bb3b256e6a5e216f1d33ef0cfb4bd0639c062be690e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lazagne


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f976cfadb68d079d3190bb3b256e6a5e216f1d33ef0cfb4bd0639c062be690e9
SHA3-384 hash: d69d97359fea97d92797c01325b9d7041383ad11d63f4aeb56f346bbb4e3880fd790935cd94840b68845ce0f0de490d0
SHA1 hash: dad695b0736d78e5edfc5d1c8a0e1463a55fbf47
MD5 hash: 44f62cd09312d201ef8014d53d9395ab
humanhash: four-hot-diet-nitrogen
File name:laZagne.exe
Download: download sample
Signature Lazagne
Create hunting rule
File size:15'062'610 bytes
First seen:2022-09-26 08:43:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 69eb46a9f63edcc604b0bdaaa8e0f2f5 (2 x DCRat, 1 x Lazagne, 1 x RedLineStealer)
ssdeep 393216:uxP3vaCncs/m3pWnKhsayGpa617/WBJHldsm/ySgimS:u5iCnrKbhsayJo7/0Ff/yhim
Threatray 38 similar samples on MalwareBazaar
TLSH T1DDE63385A2E409EAE0B66536885BD222C6B1BC550315C15F83C4A7B7BFE32D3ED72F50
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon aebc385c4ce0e8f8 (10 x PythonStealer, 7 x RedLineStealer, 7 x DCRat)
Reporter JAMESWT_WT
Tags:doncasmail-com exe Lazagne

Intelligence

File Origin
# of uploads :
1
# of downloads :
263
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Lazagne-6779429-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file
Searching for the window
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/39190/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed stealer
Link:
https://www.filescan.io/uploads/6331667cd192c333bf3edb35/reports/4e5308a1-437c-4bf4-abb2-3fc53d820618/overview
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b5b0b948-f243-4fe4-8894-ba227a252af9
Result
Threat name:
LaZagne, Mimikatz
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1077216
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected LaZagne password dumper
Yara detected Mimikatz
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f976cfadb68d079d3190bb3b256e6a5e216f1d33ef0cfb4bd0639c062be690e9/
Threat name:
Win64.Hacktool.Lazagne
Create hunting rule
Status:
Malicious
First seen:
2022-09-23 04:20:45 UTC
File Type:
PE+ (Exe)
Extracted files:
2001
AV detection:
14 of 26 (53.85%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7f3m7lnwrudz2mmqxm5sk3tklyqw6hjt54gpws6qmooamk7gsduq._file
Verdict:
unknown
Similar samples:
329d77b0ab5af0e568b9d56e3c3f7afc4266bf2cea0bd816ed4e67d4c9a09692
Lazagne
476a05d5c8ef4444f96cbd02c3a315c56227b7510f75e82249a449bb79e977fc
Lazagne
4b56d8713523dea09695ec6beef98608c234e5f8a9be77be931a687c080fb0f1
Lazagne
88214cd533e440416cb5fec9e1a419ad952cd3524274110eaa8ce8e1dbcd826a
Lazagne
a07afb3f48c05bc311adc6a9473310e6b35e14f14920e543ee8ca032a0af637f
Lazagne
acb6ddc1461c0d9e81f482f4e5738f330d01f0365b6f95e44aa5792fbe8d7376
Lazagne
af828a7abf4cb31d7e12b5a2e45e99e5009f3c9f5cefe0760fa0ab880f642794
Lazagne
b000ebdd1ec391024c2d6a953a56485a5460ca449b419bb2380f210620d72dae
Lazagne
b8e807fd68dc28227145b1fed9a72e925c24ab76495dce4733e9656740732b1b
Lazagne
d18e18eeee28b729ec305ddbafd393f3b36a8e5d6a3ba66d8c6d0eb6a1a210d0
Lazagne
+ 28 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/220926-km5xtsabd2/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/15e378ee-c909-4728-96e7-bd9b964dd0cd
Unpacked files
SH256 hash:
f976cfadb68d079d3190bb3b256e6a5e216f1d33ef0cfb4bd0639c062be690e9
MD5 hash:
44f62cd09312d201ef8014d53d9395ab
SHA1 hash:
dad695b0736d78e5edfc5d1c8a0e1463a55fbf47
Link:
https://www.unpac.me/results/3dae1d2c-a65a-4b3d-8816-6486647557ee/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f976cfadb68d079d3190bb3b256e6a5e216f1d33ef0cfb4bd0639c062be690e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HKTL_Lazagne_Gen_18
Create hunting rule
Author:Florian Roth
Description:Detects Lazagne password extractor hacktool
Reference:https://github.com/AlessandroZ/LaZagne
Rule name:HKTL_Lazagne_Gen_18_RID2DA6
Create hunting rule
Author:Florian Roth
Description:Detects Lazagne password extractor hacktool
Reference:https://github.com/AlessandroZ/LaZagne
Rule name:INDICATOR_TOOL_PWS_LaZagne
Create hunting rule
Author:ditekSHen
Description:Detects LaZagne post-exploitation password stealing tool. It is typically embedded with malware in the binary resources.
Rule name:LaZagne
Create hunting rule
Author:@bartblaze
Description:Identifies LaZagne, credentials recovery project.
Reference:https://github.com/AlessandroZ/LaZagne
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Lazagne

Executable exe f976cfadb68d079d3190bb3b256e6a5e216f1d33ef0cfb4bd0639c062be690e9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2313982/
  
Delivery method
Distributed via web download

Comments