MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea7293102864592d4fc56f6be50ec22948504281bcc120cd8e12e146d8cf3091. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Zegost

Vendor detections: 8

Intelligence 8 IOCs 1 YARA 1 File information Comments

SHA256 hash:	ea7293102864592d4fc56f6be50ec22948504281bcc120cd8e12e146d8cf3091
SHA3-384 hash:	a279ef3881b1f1660e0332e33f17d47d41c5244bc7bbd4ec0efe8295646ed46831cb4af9c4f1cbb8b39cf73bc7435cfb
SHA1 hash:	1ed0825548b6b02cc2a051700e4255db8784f2f8
MD5 hash:	5a1e121f7aaf7db7068c4920ccafda5a
humanhash:	cat-missouri-football-mississippi
File name:	5a1e121f7aaf7db7068c4920ccafda5a.exe
Download:	download sample
Signature	Zegost Create hunting rule
File size:	3'355'648 bytes
First seen:	2021-08-13 14:25:51 UTC
Last seen:	2021-08-13 15:00:53 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	84671cfacc2be8e5ef8bbdb83f60e89f (1 x Zegost)
ssdeep	98304:LdrNZop7gIj/bnLpKmNdEQcL3LyTc0JbPaNCSswvK:tIVgMnNKmNdHg3LyT77RS
Threatray	2 similar samples on MalwareBazaar
TLSH	T114F51202B981C472D5BF143809F4EA79593E78604B64DEEFA7E44F2D5E341D0AA32A73
Reporter	abuse_ch
Tags:	exe Zegost

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
43.255.241.176:1337	https://threatfox.abuse.ch/ioc/185952/

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Backdoor

Link:

https://www.capesandbox.com/analysis/179000/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader41.11114.32586.24989.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Deleting a system file

Creating a file in the Windows subdirectories

Launching a process

Adding an access-denied ACE

Connection attempt

Sending a custom TCP request

Creating a window

Sending a UDP request

Unauthorized injection to a system process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4485fe2e-a505-4ca8-b362-83fd97c8e69d

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/832485

Signature

Allocates memory in foreign processes

Antivirus detection for dropped file

Contains functionality to detect sleep reduction / modifications

Detected VMProtect packer

DLL side loading technique detected

Early bird code injection technique detected

Hides threads from debuggers

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Queues an APC in another process (thread injection)

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious Svchost Process

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to evade analysis by execution special instruction which cause usermode exception

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ea7293102864592d4fc56f6be50ec22948504281bcc120cd8e12e146d8cf3091/

Threat name:

Win32.Trojan.Johnnie

Status:

Malicious

First seen:

2021-08-13 14:26:12 UTC

AV detection:

15 of 28 (53.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5jzjgebimrms2t6fn5v6kdwcffefaqubxtasbtmoclqunwgpgciq._file

Verdict:

unknown

Zegost

Result

Malware family:

n/a

Score:

10/10

Tags:

suricata vmprotect

Link:

https://tria.ge/reports/210813-j6yhpzgrb6/

Behaviour

Checks processor information in registry

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Loads dropped DLL

VMProtect packed file

suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

suricata: ET MALWARE Downloader.Win32.Small CnC Beacon

suricata: ET MALWARE Gh0st Remote Access Trojan Encrypted Session To CnC Server

Unpacked files

SH256 hash:

994d3d395598e08e87147d780a87acc7b1e4c32e43658fb6908630cf15ba22b0

MD5 hash:

00cd943ad2e7c8c68f5de9fc22cec47a

SHA1 hash:

655f9713f6aa883bc9bbed24d60d804207119c9e

Link:

https://www.unpac.me/results/2f788df9-5a3d-485a-a1c4-38571f65e6f0/

SH256 hash:

ea7293102864592d4fc56f6be50ec22948504281bcc120cd8e12e146d8cf3091

MD5 hash:

5a1e121f7aaf7db7068c4920ccafda5a

SHA1 hash:

1ed0825548b6b02cc2a051700e4255db8784f2f8

Link:

https://www.unpac.me/results/2f788df9-5a3d-485a-a1c4-38571f65e6f0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Backdoor

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ea7293102864592d4fc56f6be50ec22948504281bcc120cd8e12e146d8cf3091

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.