Static task
static1
Behavioral task
behavioral1
Sample
AgentStop.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
AgentStop.exe
Resource
win10v2004-20220901-en
General
-
Target
AgentStop.exe
-
Size
134KB
-
MD5
9c465a8b41ed48ca13ed6e7ad317b6cb
-
SHA1
6bd9a1f19d8023ef26c7888fcef9fe095e2ec80f
-
SHA256
29f29376b85f1751f99214d9e402072e16d89128ea97b93f1a056e15fbcc7472
-
SHA512
33a962d36fe2f3db9ac8c2ee531d22d41fcefa0c4b7594d101dc526c6075f4ac5ab3fcf5c89e73286cd03c5251b31d1aa946bb5eeea206a043a940f963882b32
-
SSDEEP
3072:XBTd9XIarfWchQla7qThVoaR4kNnq1PbiuHr0ypNa8C:XBh93rfWaavFV/RAimr5C
Malware Config
Signatures
Files
-
AgentStop.exe.exe windows x86
5c39f1b2ee7831dd2de65f8afff01a25
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
LoadResource
SizeofResource
FindResourceW
FindResourceExW
LocalAlloc
GetCurrentProcessId
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LockResource
WriteFile
SetFilePointer
FindClose
CloseHandle
GetLocalTime
CreateFileW
FindNextFileW
MultiByteToWideChar
WriteConsoleW
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
GetFileSize
HeapFree
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStringTypeW
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
SetLastError
DeleteFileW
MoveFileExW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WideCharToMultiByte
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
FreeSid
AllocateAndInitializeSid
CloseServiceHandle
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
MakeSelfRelativeSD
ole32
CoCreateInstance
OleRun
CoUninitialize
CoInitializeEx
shlwapi
PathFileExistsW
oleaut32
GetErrorInfo
Sections
.text Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ