General

  • Target

    forsync.rar

  • Size

    18.1MB

  • MD5

    e2cb8cc6f63ac8feef202f4fda76bef8

  • SHA1

    e24759b5ad302aa5bc9f45b013b4848875c2cfaf

  • SHA256

    36b1e65c8e16e5b1837e126e68dfce3645351b4f6cc6a5f467aaf0b32ffade07

  • SHA512

    3a6783faba641cca7f35eff90a2539636d36c7091d7ba09e4d705fe0b2bf77e5aa94219c9736197cfdc98f4b84ece151aa7287cfc77086de010eb4f887828430

  • SSDEEP

    393216:pL66+4LLq9EwVfA9JZYU/23MWKZFYOQ6A1:lRq9d5A9oZMWKZFu6A1

Score
10/10

Malware Config

Signatures

  • AgentTesla payload 9 IoCs
  • Agenttesla family
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • forsync.rar
    .rar
  • forsync/.vs/forsync/FileContentIndex/9a4a32b9-9c5b-4aa1-8713-e2d0e2b7afe6.vsidx
  • forsync/.vs/forsync/FileContentIndex/9d8b2053-3e65-479e-82a9-f3f66051ea6e.vsidx
  • forsync/.vs/forsync/FileContentIndex/ace7ea0c-0476-4b4a-8ba5-17f8c39db33b.vsidx
  • forsync/.vs/forsync/FileContentIndex/c9c84da3-0c59-403a-88b8-1405b5290a27.vsidx
  • forsync/.vs/forsync/FileContentIndex/d93569ab-19de-4961-bb2b-5fe6050a557d.vsidx
  • forsync/.vs/forsync/v17/.suo
  • forsync/.vs/forsync/v17/DocumentLayout.json
  • forsync/forsync.sln
  • forsync/forsync/App.config
  • forsync/forsync/Form1.Designer.cs
  • forsync/forsync/Form1.cs
  • forsync/forsync/Form1.resx
    .vbs
  • forsync/forsync/Form2.Designer.cs
  • forsync/forsync/Form2.cs
    .js
  • forsync/forsync/Form2.resx
    .vbs
  • forsync/forsync/Program.cs
  • forsync/forsync/Properties/AssemblyInfo.cs
  • forsync/forsync/Properties/Resources.Designer.cs
    .vbs
  • forsync/forsync/Properties/Resources.resx
    .vbs
  • forsync/forsync/Properties/Settings.Designer.cs
  • forsync/forsync/Properties/Settings.settings
  • forsync/forsync/Resources/chip.png
    .png
  • forsync/forsync/Resources/chipcyan.png
    .png
  • forsync/forsync/Resources/closewhite.png
    .png
  • forsync/forsync/Resources/cyanpower.png
    .png
  • forsync/forsync/Resources/powerred.png
    .png
  • forsync/forsync/Resources/usercyan.png
    .png
  • forsync/forsync/Resources/userred.png
    .png
  • forsync/forsync/Resources/userwhite.png
    .png
  • forsync/forsync/Resources/velologo.png
    .png
  • forsync/forsync/Resources/xhipred.png
    .png
  • forsync/forsync/bin/Debug/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/forsync/bin/Debug/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/forsync/bin/Debug/Newtonsoft.Json.xml
    .xml
  • forsync/forsync/bin/Debug/forsync.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • forsync/forsync/bin/Debug/forsync.exe.config
  • forsync/forsync/bin/Debug/forsync.pdb
  • forsync/forsync/forsync.csproj
  • forsync/forsync/obj/Debug/.NETFramework,Version=v4.7.2.AssemblyAttributes.cs
  • forsync/forsync/obj/Debug/DesignTimeResolveAssemblyReferences.cache
  • forsync/forsync/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache
  • forsync/forsync/obj/Debug/TempPE/Properties.Resources.Designer.cs.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • forsync/forsync/obj/Debug/forsync.Form1.resources
  • forsync/forsync/obj/Debug/forsync.Form2.resources
  • forsync/forsync/obj/Debug/forsync.Properties.Resources.resources
  • forsync/forsync/obj/Debug/forsync.csproj.AssemblyReference.cache
  • forsync/forsync/obj/Debug/forsync.csproj.CoreCompileInputs.cache
  • forsync/forsync/obj/Debug/forsync.csproj.FileListAbsolute.txt
  • forsync/forsync/obj/Debug/forsync.csproj.GenerateResource.cache
  • forsync/forsync/obj/Debug/forsync.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • forsync/forsync/obj/Debug/forsync.pdb
  • forsync/forsync/packages.config
  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/.signature.p7s
  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/Guna.UI2.WinForms.2.0.4.6.nupkg
    .nupkg
  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/LICENSE.txt
  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/README.md
  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/icon.png
    .png
  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/lib/net40/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/lib/net45/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/lib/net461/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/lib/net472/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/lib/net48/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/lib/net6.0-windows7.0/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/lib/net7.0-windows7.0/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Guna.UI2.WinForms.2.0.4.6/lib/netcoreapp3.1/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Newtonsoft.Json.13.0.3/.signature.p7s
  • forsync/packages/Newtonsoft.Json.13.0.3/LICENSE.md
  • forsync/packages/Newtonsoft.Json.13.0.3/Newtonsoft.Json.13.0.3.nupkg
    .nupkg
  • forsync/packages/Newtonsoft.Json.13.0.3/README.md
  • forsync/packages/Newtonsoft.Json.13.0.3/lib/net20/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Newtonsoft.Json.13.0.3/lib/net20/Newtonsoft.Json.xml
    .xml
  • forsync/packages/Newtonsoft.Json.13.0.3/lib/net35/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Newtonsoft.Json.13.0.3/lib/net35/Newtonsoft.Json.xml
    .xml
  • forsync/packages/Newtonsoft.Json.13.0.3/lib/net40/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Newtonsoft.Json.13.0.3/lib/net40/Newtonsoft.Json.xml
    .xml
  • forsync/packages/Newtonsoft.Json.13.0.3/lib/net45/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Newtonsoft.Json.13.0.3/lib/net45/Newtonsoft.Json.xml
    .xml
  • forsync/packages/Newtonsoft.Json.13.0.3/lib/net6.0/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Newtonsoft.Json.13.0.3/lib/net6.0/Newtonsoft.Json.xml
    .xml
  • forsync/packages/Newtonsoft.Json.13.0.3/lib/netstandard1.0/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Newtonsoft.Json.13.0.3/lib/netstandard1.0/Newtonsoft.Json.xml
    .xml
  • forsync/packages/Newtonsoft.Json.13.0.3/lib/netstandard1.3/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Newtonsoft.Json.13.0.3/lib/netstandard1.3/Newtonsoft.Json.xml
    .xml
  • forsync/packages/Newtonsoft.Json.13.0.3/lib/netstandard2.0/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/Newtonsoft.Json.13.0.3/lib/netstandard2.0/Newtonsoft.Json.xml
    .xml
  • forsync/packages/Newtonsoft.Json.13.0.3/packageIcon.png
    .png
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/.signature.p7s
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/System.Runtime.Serialization.Json.4.3.0.nupkg
    .nupkg
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ThirdPartyNotices.txt
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/dotnet_library_license.txt
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/lib/netcore50/System.Runtime.Serialization.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/lib/netstandard1.3/System.Runtime.Serialization.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netcore50/System.Runtime.Serialization.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netcore50/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netcore50/de/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netcore50/es/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netcore50/fr/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netcore50/it/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netcore50/ja/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netcore50/ko/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netcore50/ru/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netcore50/zh-hans/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netcore50/zh-hant/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netstandard1.0/System.Runtime.Serialization.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netstandard1.0/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netstandard1.0/de/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netstandard1.0/es/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netstandard1.0/fr/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netstandard1.0/it/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netstandard1.0/ja/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netstandard1.0/ko/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netstandard1.0/ru/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netstandard1.0/zh-hans/System.Runtime.Serialization.Json.xml
  • forsync/packages/System.Runtime.Serialization.Json.4.3.0/ref/netstandard1.0/zh-hant/System.Runtime.Serialization.Json.xml