General

  • Target

    kayflock-beta.rar

  • Size

    9.9MB

  • MD5

    97aa3a079dd9755550f3dc33b5cfc215

  • SHA1

    68706f4f9fada471773b87c051c1d0bbc0da1ac6

  • SHA256

    9ecbf28720a944bdd3f3c20cdb3f4da7f40da903b651be520348e01a8efa2504

  • SHA512

    bb94b7252d1eaf201ec3bac6ed154159c30c69759d9683866be1be4ee6c173581eb5ab033e5fb346dfb0eb811ec850204ae2b925d125230579c6978e7737990a

  • SSDEEP

    196608:I9wZUrLVz1Ik1+pfk/1eAD5kh7mv486rCujLl/yvhEW9NZ1elAbinuDll:FY1zWk/1XD5Y7VPjhyvSWHZ1AGinGll

Score
10/10

Malware Config

Signatures

  • AgentTesla payload 1 IoCs
  • Agenttesla family
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

Files

  • kayflock-beta.rar
    .rar

    Password: oh fuck yla

  • kayflock-beta/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    Password: oh fuck yla

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • kayflock-beta/System.Management.dll
    .dll windows:4 windows x86 arch:x86

    Password: oh fuck yla

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • kayflock-beta/byfron.deps.json
  • kayflock-beta/byfron.dll
    .exe windows:4 windows x86 arch:x86

    Password: oh fuck yla

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • kayflock-beta/byfron.pdb
  • kayflock-beta/byfron.runtimeconfig.json
  • kayflock-beta/kayflock.exe
    .exe windows:6 windows x64 arch:x64

    Password: oh fuck yla

    6dbf27f4c70fe2c8ed3e0122ba75d641


    Headers

    Imports

    Sections

  • kayflock-beta/nexus.dll
    .dll windows:4 windows x86 arch:x86

    Password: oh fuck yla

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • kayflock-beta/packages/ranks/Core.xml
  • kayflock-beta/packages/ranks/DtcInstall.log
  • kayflock-beta/packages/ranks/HelpPane.exe
    .exe windows:10 windows x64 arch:x64

    Password: oh fuck yla

    77598c173b521d9294a60fea0a91cc1e


    Headers

    Imports

    Sections

  • kayflock-beta/packages/ranks/PFRO.log
  • kayflock-beta/packages/ranks/WMSysPr9.prx
  • kayflock-beta/packages/ranks/bfsvc.exe
    .exe windows:10 windows x64 arch:x64

    Password: oh fuck yla

    8f37383f783aa5f937062790b2149d46


    Headers

    Imports

    Sections

  • kayflock-beta/packages/ranks/bootstat.dat
  • kayflock-beta/packages/ranks/explorer.exe
    .exe windows:10 windows x64 arch:x64

    Password: oh fuck yla

    54dc9b405d017a6766f4cd96028ba126


    Code Sign

    Headers

    Imports

    Sections

  • kayflock-beta/packages/ranks/fullstack-magic.exe
    .exe windows:6 windows x64 arch:x64

    cda4bf1ee2e43c5921d64b48cad76c9e


    Headers

    Imports

    Sections

  • kayflock-beta/packages/ranks/hh.exe
    .exe windows:10 windows x64 arch:x64

    d3d9c3e81a404e7f5c5302429636f04c


    Headers

    Imports

    Sections

  • kayflock-beta/packages/ranks/lsasetup.log
  • kayflock-beta/packages/ranks/mib.bin
  • kayflock-beta/packages/ranks/notepad.exe
    .exe windows:10 windows x64 arch:x64

    09ed737a03db7295bf734a9953f6eb5e


    Headers

    Imports

    Sections

  • kayflock-beta/packages/ranks/setupact.log
  • kayflock-beta/packages/ranks/splwow64.exe
    .exe windows:10 windows x64 arch:x64

    0c613b55d7b5ccc10e4a17a05d719c8e


    Headers

    Imports

    Sections

  • kayflock-beta/packages/ranks/system.ini
  • kayflock-beta/packages/ranks/twain_32.dll
    .dll windows:10 windows x86 arch:x86

    316cd668ed705c998eae8d3bd7bd168f


    Headers

    Imports

    Exports

    Sections

  • kayflock-beta/packages/ranks/win.ini
  • kayflock-beta/packages/ranks/winhlp32.exe
    .exe windows:10 windows x86 arch:x86

    0dfde2c713801a5c7e6dc0108384fb68


    Headers

    Imports

    Sections

  • kayflock-beta/packages/ranks/write.exe
    .exe windows:10 windows x64 arch:x64

    90a23f469ba0443719430cba4569b220


    Headers

    Imports

    Sections

  • kayflock-beta/runtimes/win/lib/net6.0/System.Management.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections