fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

7

HEUR-Troja...97.exe

windows7-x64

HEUR-Troja...97.exe

windows10-2004-x64

Sharing

General

Target

HEUR-Trojan.MSIL.Agent.gen-fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997.exe
Size

555KB
Sample

220924-lm7l4aahh5
MD5

2102422fdf58e1f1ea628e864576f437
SHA1

a071690fa220c12e9b5fa85e70dc3e7c42b30893
SHA256

fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997
SHA512

9894a54a6c85ce3e087ef6f2a6da1a5744d71667eaa8f17d23985e15c39a425cfe53f838875573e828170ce6d3756618c4b293e3d81dfc7a7a5570daf2c0c2b6
SSDEEP

12288:gfp3lxis8EdrQso5hnyRIAPQJno5hnyRIAQg:gfp36sN5snUPjnUQg

Score

10^/10

agilenet evasion ransomware trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

HEUR-Trojan.MSIL.Agent.gen-fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997.exe

Resource

win7-20220901-en

agilenet evasion ransomware trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

HEUR-Trojan.MSIL.Agent.gen-fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997.exe

Resource

win10v2004-20220812-en

agilenet evasion ransomware trojan

windows10-2004-x64

20 signatures

150 seconds

Malware Config

Targets

- Target
  
  HEUR-Trojan.MSIL.Agent.gen-fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997.exe
- Size
  
  555KB
- MD5
  
  2102422fdf58e1f1ea628e864576f437
- SHA1
  
  a071690fa220c12e9b5fa85e70dc3e7c42b30893
- SHA256
  
  fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997
- SHA512
  
  9894a54a6c85ce3e087ef6f2a6da1a5744d71667eaa8f17d23985e15c39a425cfe53f838875573e828170ce6d3756618c4b293e3d81dfc7a7a5570daf2c0c2b6
- SSDEEP
  
  12288:gfp3lxis8EdrQso5hnyRIAPQJno5hnyRIAQg:gfp36sN5snUPjnUQg
Score

10^/10

agilenet evasion ransomware trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Clears Windows event logs
  evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Windows security modification
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Disabling Security Tools

File Deletion

Indicator Removal on Host

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

agilenetevasionransomwaretrojan

behavioral2

agilenetevasionransomwaretrojan

© 2018-2025

Terms | Privacy