Categories: Backdoor

Backdoor:Win32/Zegost.CB information

The Backdoor:Win32/Zegost.CB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Zegost.CB virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Backdoor:Win32/Zegost.CB?


File Info:
name: E9E177BFD79F157A49C7.mlwpath: /opt/CAPEv2/storage/binaries/6a8b5b95e6d5b617846d01d082d86c4bacef22161782b13fa2420cafc2ac73f5crc32: 02FE9CCAmd5: e9e177bfd79f157a49c7c4c157c0254fsha1: c0fe0e1bf821a2dbbed70f4a58ce440684a3e24csha256: 6a8b5b95e6d5b617846d01d082d86c4bacef22161782b13fa2420cafc2ac73f5sha512: c3d39b060ccb8b52dbe599d62ea359ed3757c426944504632546bb0bb4ffb1e58dff93aab15c15f4d05f934d4752c07421f865bab951cc3937fa5f4e1ca59762ssdeep: 3072:Q9+/qlBWOWoG4QPX1P0tB70MTAdh+reD7lJ7Kgr8J7Kyr:Q0xOWom/Ktpz0dMredJ7Kgr8J7Kyrtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T180D38F12F6C540FEE9A4153C28FF77369A3FBD954A189E876324EE591833110AB32397sha3_384: ce05a7ded17b01663fd6457d02e3ce88c46d8c4dea93496a053eae9deeb4f37b3eae77574e7ff1d8e042ebdc443bf2a6ep_bytes: 558bec6aff68b833400068dc18400064timestamp: 2009-02-25 01:56:03
Version Info:
0: [No Data]

Backdoor:Win32/Zegost.CB also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	MemScan:Trojan.Generic.2453755
ClamAV	Win.Trojan.Magania-9773343-0
FireEye	Generic.mg.e9e177bfd79f157a
CAT-QuickHeal	Trojan.Redosdru.A
ALYac	MemScan:Trojan.Generic.2453755
Cylance	unsafe
Zillya	Trojan.Magania.Win32.9018
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 00165e881 )
Alibaba	TrojanSpy:Win32/Batton.db2a8207
K7GW	Trojan ( 00165e881 )
CrowdStrike	win/malicious_confidence_100% (W)
Baidu	Win32.Backdoor.Agent.ep
VirIT	Trojan.Win32.Agent2.AMNL
Cyren	W32/OnlineGames.BX.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/PSW.Agent.NMN
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	Trojan-Spy.Win32.Batton.vny
BitDefender	MemScan:Trojan.Generic.2453755
NANO-Antivirus	Trojan.Win32.AntiAV.bgbct
Avast	Win32:BackDoor-AFB [Trj]
Tencent	Backdoor.Win32.Gh0st.g
TACHYON	Trojan-PWS/W32.WebGame.138848.B
Emsisoft	MemScan:Trojan.Generic.2453755 (B)
F-Secure	Trojan.TR/Crypt.FKM.Gen
DrWeb	Trojan.DownLoader4.56850
VIPRE	MemScan:Trojan.Generic.2453755
TrendMicro	TSPY_MAGANIA.SMJ
McAfee-GW-Edition	BackDoor-DVB.o.d
Sophos	Troj/Redosdru-B
SentinelOne	Static AI – Suspicious PE
GData	MemScan:Trojan.Generic.2453755
Jiangmin	Trojan/PSW.Magania.smh
Avira	TR/Crypt.FKM.Gen
Antiy-AVL	Trojan[GameThief]/Win32.Magania
Xcitium	TrojWare.Win32.GameThief.Magania.~NWABL@1775f6
Arcabit	Trojan.Generic.D2570FB
ViRobot	Trojan.Win32.PSWMagania.144784
ZoneAlarm	Trojan-Spy.Win32.Batton.vny
Microsoft	Backdoor:Win32/Zegost.CB
Google	Detected
AhnLab-V3	Trojan/Win32.CSon.R211
McAfee	GenericRXAA-AA!E9E177BFD79F
MAX	malware (ai score=100)
VBA32	BScope.Trojan.SvcHorse.01643
Malwarebytes	Generic.Malware.AI.DDS
Panda	Generic Malware
TrendMicro-HouseCall	TSPY_MAGANIA.SMJ
Rising	Backdoor.Win32.Mnless.bzk (CLASSIC)
Yandex	Trojan.GenAsa!aZ5hw1hfuWo
Ikarus	Trojan-Dropper.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Magania.BBT!tr.pws
BitDefenderTheta	AI:Packer.080119651C
AVG	Win32:BackDoor-AFB [Trj]
Cybereason	malicious.fd79f1
DeepInstinct	MALICIOUS