Zeogen-main.zip
- SHA256 0733e1d0f84d81fe78d095aa0089ff0ec5157b64e2f0da8ff2482c30e7f27ab1
Behavioral task
behavioral1
Sample
Zeogen-main.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral2
Sample
Zeogen-main.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral3
Sample
Zeogen-main/Zeogen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral4
Sample
Zeogen-main/Zeogen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
600 seconds
General
- Target Zeogen-main.zip
- Size 6.4MB
- Sample260926-2zpj2stbme
- SHA256 0733e1d0f84d81fe78d095aa0089ff0ec5157b64e2f0da8ff2482c30e7f27ab1
- MD5 f549a3ec38c80f5433627fea2bf22c70
- SHA1 33e105e31e195a9cee457afb6e478fa6500039ab
- SHA512 99e7b06ccc6ca1e5191ce5f4d6693300945e08f8e984616b6e6a5454eac50e7d5dc0eedb8f50064242bca25a58e35fbe24abd110fe24b99feeb909e741090b99
- SSDEEP 196608:AnjpAFFUkmUvBPuXuiJvUcRBIhAuUNlJM1DSX:ItAFFUkmqBPuX/JvU8I6NlJM12
- TLSH T17D66334D7EC23F91D1A3B8161C1169718823973AF84ABCC08322CA5425DFEF69D65DEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Zeogen-main/Zeogen.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Zeogen-main/Zeogen.exe
File Explorer
-
Zeogen-main.zip.zip 6.4MB
-
Zeogen-main/README.md111B
-
Zeogen-main/Zeogen.exe.exe 6.6MB
-
zeogen.pyc9KB
-
Zeogen-main/Zeogen.py14KB
Zeogen-main/README.md
- SHA256 58dcd815e77e136a6abd1038d8811cc3a1d61394e980163f24e68f0aa927fa28
- MD5 7a727ee7e058c191a13e8b2908cbebc8
- SHA1 a0e40a1ca240b4d652ba25eebe5fa3e8c92d538b
- SHA512 9538d867d5fb13107dbe06418db623738eeffe7484a454c1dc96649fbe80589d83cac090a9f95b15b942cfc738e333eba5a2bbb3d17b3abf8bc7fbccc40595d5
- TLSH T17FB0123D23DE800040E797A506F092723C6D044223274D6F76F05EE0A3D84A4C1316F2
- MD5 SHA1 SHA512 TLSH
Zeogen-main/Zeogen.exe
- IMPHASH d170e2e5adcfc4c271f2eb78a565305e
- SHA256 43717d6c756379b64d7f8289e2bcd7a585ced7fcde720db6171a190de648dbd2
- MD5 c6c519e43407eaaaf240077f1e8fa418
- SHA1 d5b20223f96619e997ab58d5e98cd10322a2abd3
- SHA512 db7c66076db109c245104b90e82cf9bb2773e9d501501e752bf91fd3b59b03f2d1c33afd1f86f558f2930f4aa80a2a2aa449ea4d4a588bf12b06cd3d2fe870a6
- SSDEEP 196608:8T6DSL2Vmd6+D0JJVAzDaku99mEQcy6d/AyfRL6:PSL2Vmd6m0JJVAzDakArZd/Ayf
- TLSH T19C66334477403DA6E0BB1032CC518132D537BD266616C9DB87B889626F1BBF26D3AFE1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
40240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
GetStartupInfoW
FreeLibrary
LoadLibraryExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
CreateProcessW
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RaiseException
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=7, id=259, version=27412,
count=186, id=261, version=27412,
count=3, id=253, version=28518,
count=38, id=261, version=30034,
count=17, id=260, version=30034,
count=9, id=259, version=30034,
count=5, id=257, version=27412,
count=113, id=1, productName=Unmarked objects,
count=19, id=260, productName=VS2019 v16.11.8 build 30138, version=30138,
count=1, id=258, productName=VS2019 v16.11.8 build 30138, version=30138,
zeogen.pyc
- SHA256 e87646cac23981b376c6dfed83e51c54a1368b7bbdb70f927b9c513aec51e5e9
- MD5 a3f5a9be5ff5b726b5ed338a36fa754b
- SHA1 35e1a0f0838e2db24cb9ef4cb78cab9243b00b11
- SHA512 5f24d2c6743b8d4418258b35fc5787da5213444c91a4b8b899ac52f05c3dacd5994fcc1887c5445ac32a605bbde29b44e649c44b75c49948f88158647000da32
- SSDEEP 192:DpBMAlg11C/AVUerkIaMpevGhH6f8Fx4xkImnfOeWXiZ/QO:DwAlg11C/AWerkIa6GGhHA8FxUnmnlyE
- TLSH T10A129AA396995A2CFD2461765885D909E271EECDF0C536F1B5FE80A2DF4E3C0361029F
- MD5 SHA1 SHA512 SSDEEP TLSH
Zeogen-main/Zeogen.py
- SHA256 674776bc5cb4556b72989b57c66fa69daa5fac268e288b94eb5943d72cb189b9
- MD5 670372385681c0134e40d37d6f3cce6d
- SHA1 6ad8ea5d66b1db76cb6312b8b2d3d1eca7e0213c
- SHA512 a860b38d91d8b8dd50ce1dcc77345250553e2ae5190fa45f004f579e4be81c10003d5da8bd85577617d3dd9b4d8b39fc326cc90170b2ae3229a51abc41a37199
- SSDEEP 96:bNt4eipqmYK/SEosoEoAMMJkZtuBeiQlVbcOniHvncH44C84nU7vCDWLBQJW++HA:pp8VeN3bcOi/cY4C8xGIGL
- TLSH T10862E9A9BED0081804A6497DD3C7718FEEAE310352795C9A366EB0106F7378937F5A2D
- MD5 SHA1 SHA512 SSDEEP TLSH