DITEKSHEN_MALWARE_Win_Zegost

rule DITEKSHEN_MALWARE_Win_Zegost : FILE
{
	meta:
		description = "Detects Zegost"
		author = "ditekSHen"
		id = "cce29602-c096-53df-a99b-16f18ed43b80"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4534-L4560"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "96727a0f5c113e5cdfe871f104553fd1c04a8f63ecbb8db7223afb71fcdd4087"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "rtvscan.exe" fullword ascii
		$s2 = "ashDisp.exe" fullword ascii
		$s3 = "KvMonXP.exe" fullword ascii
		$s4 = "egui.exe" fullword ascii
		$s5 = "avcenter.exe" fullword ascii
		$s6 = "K7TSecurity.exe" fullword ascii
		$s7 = "TMBMSRV.exe" fullword ascii
		$s8 = "RavMonD.exe" fullword ascii
		$s9 = "kxetray.exe" fullword ascii
		$s10 = "mssecess.exe" fullword ascii
		$s11 = "QUHLPSVC.EXE" fullword ascii
		$s12 = "360tray.exe" fullword ascii
		$s13 = "QQPCRTP.exe" fullword ascii
		$s14 = "knsdtray.exe" fullword ascii
		$s15 = "V3Svc.exe" fullword ascii
		$s16 = "??1_Winit@std@@QAE@XZ" fullword ascii
		$s17 = "ClearEventLogA" fullword ascii
		$s18 = "SeShutdownPrivilege" fullword ascii
		$s19 = "%s\\shell\\open\\command" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}