jaffacakes118_Backdoor[.]Win32[.]Zegost[.]mtcvf[.]03a8f09f510b7c626b2b7347a2275c9c

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Backdoor.Win32.Zegost.mtcvf.03a8f09f510b7c626b2b7347a2275c9c
Size 3.5MB
Sample261015-payefacv71
SHA256 0ce83532b57ba9bb114fdb74b5a90860b6b22859508f7b3e7ad6bf5ea4eddf65
MD5 03a8f09f510b7c626b2b7347a2275c9c
SHA1 62e11eeba31f0e4e5f6947c85f7898c1e54c7188
SHA512 deeb59da3f4398f13bffc3a77d2772a15b50ac2b8303bbf01da33e0d154b67008a2b25322b370b4659e6419977931390a1d8d74b32e73c5c9871f6617e58cfed
SSDEEP 98304:Uj19EEmnYgcvkbs6Q4lUtXlHOjEGquO0ubJ9S:UPzmnYg8kbsISVdGquLuu
TLSH
T1900633D58FD49941028D06BFAFCDB6D8F7C2A8A13F05F48D88BC218851969DDAD20F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/天刑版本.exe

File Explorer

jaffacakes118_Backdoor.Win32.Zegost.mtcvf.03a8f09f510b7c626b2b7347a2275c9c

.zip 3.5MB
代码大全.txt

43KB
使用说明.txt

815B
天刑版本.exe

.exe 4.0MB

jaffacakes118_Backdoor.Win32.Zegost.mtcvf.03a8f09f510b7c626b2b7347a2275c9c

SHA256 0ce83532b57ba9bb114fdb74b5a90860b6b22859508f7b3e7ad6bf5ea4eddf65
MD5 03a8f09f510b7c626b2b7347a2275c9c
SHA1 62e11eeba31f0e4e5f6947c85f7898c1e54c7188
SHA512 deeb59da3f4398f13bffc3a77d2772a15b50ac2b8303bbf01da33e0d154b67008a2b25322b370b4659e6419977931390a1d8d74b32e73c5c9871f6617e58cfed
SSDEEP 98304:Uj19EEmnYgcvkbs6Q4lUtXlHOjEGquO0ubJ9S:UPzmnYg8kbsISVdGquLuu
TLSH
T1900633D58FD49941028D06BFAFCDB6D8F7C2A8A13F05F48D88BC218851969DDAD20F6D
MD5 SHA1 SHA512 SSDEEP TLSH

天刑版本.exe

IMPHASH 380d371a038ae73f1e69ace56a06ed5b
SHA256 df28984cb3b7666d2116f9a7ac3871e30b13a60bdf4efb2475824bd70fb6102f
MD5 9a410a512eec77c6524cabe0177871b5
SHA1 1233589e580d607a4d8f2a225ac7eeb7d8c33494
SHA512 f471c2cfa91a04f4dac4071a2b56ee32542798ac0c0892b2a256e367e7d2fe80c87bb92fe58ecd85f669dbf253bf17467f473af10bdef057444cbb4a41343e22
SSDEEP 98304:geMiQg7u/hYOnFbBgKdn2dYfbZTvOLioRwNfpaEJY6VVYQK1S+LE29070CPNt:zv7uhYOFbBgK8yZTve0tVVYp3LPQ
TLSH
T128161201B69191F2C619057508ABE7B5EA7AAD024F20DFC35B58FE6D5D332C1EA3720E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

297559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize TerminateProcess GetLocalTime GetSystemTime GetTimeZoneInformation RaiseException RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags FreeEnvironmentStringsW GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetStdHandle WideCharToMultiByte MultiByteToWideChar GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource RemoveDirectoryA GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA WinExec lstrcpyA FindNextFileA CloseHandle GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA lstrlenA GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject GetCurrentThread

user32

GetForegroundWindow SystemParametersInfoA LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetSystemMenu DeleteMenu GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos InflateRect SetRect IntersectRect DestroyIcon UnregisterClassA OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetSysColorBrush GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle PtInRect

gdi32

GetTextMetricsA LineTo Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn SetBkColor CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject GetObjectA CreatePen PatBlt FillRgn CreateRectRgn CombineRgn CreateSolidBrush MoveToEx ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetTextColor SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps

winmm

midiOutReset midiStreamRestart midiStreamStop midiStreamOut waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause midiOutPrepareHeader midiStreamProperty waveOutReset waveOutClose waveOutGetNumDevs waveOutOpen midiOutUnprepareHeader midiStreamOpen midiStreamClose

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegOpenKeyExA RegCreateKeyExA RegCloseKey RegSetValueExA RegQueryValueA

shell32

ShellExecuteA Shell_NotifyIconA SHGetSpecialFolderPathA

ole32

OleUninitialize OleInitialize CLSIDFromString

oleaut32

UnRegisterTypeLi RegisterTypeLi LoadTypeLi

comctl32

ImageList_Destroy ord17

ws2_32

inet_ntoa WSACleanup closesocket WSAAsyncSelect recvfrom ioctlsocket recv getpeername accept

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseColorA