MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c536c1558eba42c1967d9732bf9afd25c9c3c28bfbdc0028b945e88f1141d90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Zegost


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c536c1558eba42c1967d9732bf9afd25c9c3c28bfbdc0028b945e88f1141d90
SHA3-384 hash: 7383e993f017af03394fd3b2766e94ddfb408e1eb822cfcf4b33dca0c8e62c38e352c4f36d4e0469c01d304535bec04c
SHA1 hash: 3d0a267b5f9b1f966d9577b0f7f797c813ab8b80
MD5 hash: 369af7277751019de4e0a12b294d24de
humanhash: crazy-lithium-berlin-october
File name:369af7277751019de4e0a12b294d24de
Download: download sample
Signature Zegost
Create hunting rule
File size:188'416 bytes
First seen:2021-06-15 03:31:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 07cd32fe06d43febfbbba5706c9ac01e (4 x Gh0stRAT, 2 x Zegost)
ssdeep 3072:mtABk6W//OzY3qKz05HOScaZLCbnUvH6+gxF13+ea2rXYShBdj7ExxwXDGLOqPfC:GABk6W/M1KKRCXvlYShPYxxwHqPf1mI
TLSH 7D046C42B67A48E1E5FD84FF7C72491D50B7F4586980B9AE9A0BD538E46D3E039300EE
Reporter zbetcheckin
Tags:32 exe Zegost

Intelligence

File Origin
# of uploads :
1
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Redosdru-9753707-0
Create hunting rule

MiscreantPunch.SingleXOR.EXE.49.UNOFFICIAL
Create hunting rule

Win.Trojan.Agent-174654
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a service
Creating a file in the %temp% directory
Moving a file to the Windows subdirectory
Launching a service
Launching a process
Sending a UDP request
Sending a custom TCP request
Possible injection to a system process
Enabling autorun for a service
Deleting of the original file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Gh0st RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cfdaeace-23a1-4de2-8051-8cff6df92566
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/802098
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to detect sleep reduction / modifications
Creates a Windows Service pointing to an executable in C:\Windows
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c536c1558eba42c1967d9732bf9afd25c9c3c28bfbdc0028b945e88f1141d90/
Threat name:
Win32.Backdoor.PcClient
Create hunting rule
Status:
Malicious
First seen:
2021-06-14 10:46:06 UTC
AV detection:
29 of 29 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hrjwyfky5oscyglh3fzsx6np2jojypbix664aaulsrpir4iudwia._file
Verdict:
suspicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
bootkit persistence
Link:
https://tria.ge/reports/210615-8zl6p6hg1x/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Drops file in System32 directory
Writes to the Master Boot Record (MBR)
Deletes itself
Loads dropped DLL
Sets DLL path for service in the registry
Unpacked files
SH256 hash:
143927aeba6fcf903930711bed63f8477bfc4846d6e0da29ec2e6ae83f1c7ccb
MD5 hash:
d6ecd13a5e458e34282e3f226d227b7f
SHA1 hash:
2b1517b9e00a1a431f5ac65252090cc9934ece49
Link:
https://www.unpac.me/results/fe31d6f1-3aaf-4796-b8af-5d84aa71694d/
SH256 hash:
3c536c1558eba42c1967d9732bf9afd25c9c3c28bfbdc0028b945e88f1141d90
MD5 hash:
369af7277751019de4e0a12b294d24de
SHA1 hash:
3d0a267b5f9b1f966d9577b0f7f797c813ab8b80
Link:
https://www.unpac.me/results/fe31d6f1-3aaf-4796-b8af-5d84aa71694d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3c536c1558eba42c1967d9732bf9afd25c9c3c28bfbdc0028b945e88f1141d90

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Backdoor_Redosdru_Jun17
Create hunting rule
Author:Florian Roth
Description:Detects malware Redosdru - file systemHome.exe
Reference:https://goo.gl/OOB3mH
Rule name:ZxShell_Related_Malware_CN_Group_Jul17_3
Create hunting rule
Author:Florian Roth
Description:Detects a ZxShell related sample from a CN threat group
Reference:https://blogs.rsa.com/cat-phishing/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Zegost

Executable exe 3c536c1558eba42c1967d9732bf9afd25c9c3c28bfbdc0028b945e88f1141d90

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1367417/

Comments