agniane.7z
- SHA256 ae190a62bddd279a0b4db41594da931cbfc97661594fc9ccd386f9f690cf8efd
Overview
overview
10Static
static
1038085ad40d...ac.bat
windows10-ltsc_2021-x64
738085ad40d...ac.bat
windows11-21h2-x64
7JC_abce9c1...af.exe
windows10-ltsc_2021-x64
10JC_abce9c1...af.exe
windows11-21h2-x64
10f131ed3f63...a5.exe
windows10-ltsc_2021-x64
6f131ed3f63...a5.exe
windows11-21h2-x64
6fc1b0f0448...21.exe
windows10-ltsc_2021-x64
7fc1b0f0448...21.exe
windows11-21h2-x64
7Behavioral task
behavioral1
Sample
38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac.bat
Resource
win10ltsc2021-20250425-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac.bat
Resource
win11-20250502-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
JC_abce9c19df38717374223d0c45ce2d199f77371e18f9259b9b145fe8d5a978af.exe
Resource
win10ltsc2021-20250425-en
windows10-ltsc_2021-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
JC_abce9c19df38717374223d0c45ce2d199f77371e18f9259b9b145fe8d5a978af.exe
Resource
win11-20250502-en
windows11-21h2-x64
14 signatures
150 seconds
Behavioral task
behavioral5
Sample
f131ed3f634405ae488ed4164f8e3d856bb55a71764a0cbe16f42230fc3283a5.exe
Resource
win10ltsc2021-20250425-en
windows10-ltsc_2021-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
f131ed3f634405ae488ed4164f8e3d856bb55a71764a0cbe16f42230fc3283a5.exe
Resource
win11-20250502-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
fc1b0f044807d4f0f7d3c68c1adb2f38da0f8a577e11322102559b6467c1fd21.exe
Resource
win10ltsc2021-20250425-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
General
- Target agniane.7z
- Size 382KB
- Sample250607-1tg3ca1ry5
- SHA256 ae190a62bddd279a0b4db41594da931cbfc97661594fc9ccd386f9f690cf8efd
- MD5 53d5d8b2abfd1e01989c0d1368c25e20
- SHA1 0917cd0bece6594ea63b96104a6d62a7282e7d44
- SHA512 06987e56bd2e63825899485a5026f0d64f9f5c1c6ba7d333249b674ee151bbf7f356d118bacbcc56f209d8f77719a70ac7d249b60947cc0b71cf6346a42d8ef2
- SSDEEP 6144:b5fJFA8BKkxxuIK/7VmcJPXbBQ9vnq8TemXpbhTMDFSN6F/8r5TdFuEB877jEbJ1:VfJW8BKkxxC/tNQPqsXnMDFMk/4H1U7o
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
agniane
C2
-
https://central-cee-doja.ru//antivm.php?id=REPLACEUSER1D
-
https://central-cee-doja.ru//ferr.php?id=REPLACEUSER1D
Signatures
- Agniane family
- Cinoshi family
- Detect Cinoshi payload 1 IoCs
resource yara_rule static1/unpack001/JC_abce9c19df38717374223d0c45ce2d199f77371e18f9259b9b145fe8d5a978af family_cinoshi - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/JC_abce9c19df38717374223d0c45ce2d199f77371e18f9259b9b145fe8d5a978af unpack001/fc1b0f044807d4f0f7d3c68c1adb2f38da0f8a577e11322102559b6467c1fd21.exe
File Explorer
-
agniane.7z.7z 382KB
-
38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac.bat303KB
-
JC_abce9c19df38717374223d0c45ce2d199f77371e18f9259b9b145fe8d5a978af.exe 199KB
-
f131ed3f634405ae488ed4164f8e3d856bb55a71764a0cbe16f42230fc3283a5.exe.exe 244KB
-
fc1b0f044807d4f0f7d3c68c1adb2f38da0f8a577e11322102559b6467c1fd21.exe.exe 142KB
38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac.bat
- SHA256 38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac
- MD5 02e3492ec9f0b6068adee89e025e08eb
- SHA1 15cdcbb1a619312b6664ac5f1ab938a8a49ba328
- SHA512 3bdd14e992dd007e86480cb04f609efbeea9741219ee1e64434c97f20f5ed6393600d169e1a852e4fd8b100cdb87813d987651bf90f390ee80c7eefae7d8920a
- SSDEEP 6144:iOQO6m8Lhoc/qIRM5G2N9e2gqi3Y2h+qFLFlOy2MNf2QuxMLT5H:Njh8GG3RM5h3zHi3Y2JZCAcW
- MD5 SHA1 SHA512 SSDEEP
JC_abce9c19df38717374223d0c45ce2d199f77371e18f9259b9b145fe8d5a978af
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 abce9c19df38717374223d0c45ce2d199f77371e18f9259b9b145fe8d5a978af
- MD5 0d20e90382f881116201ac7c9298aab6
- SHA1 217d943f86ab19cfcab9b34db84807a663e1e3fe
- SHA512 c99d4f7afdc6b200c41976b30eaf50a78555f6feb0127c79f368b397301f9c98b25da11389da198e540516bc10dec942709848c6ec936a56cb1d4617af820ce5
- SSDEEP 3072:2yui35przV2uZ7PHd2AKrIeHIlI/E73BXu3Wpiv:KinrRTVKrPiI
- MD5 SHA1 SHA512 SSDEEP
-
Detect Cinoshi payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
207278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Keepye\Desktop\123\obj\Release\Agniane.pdb
mscoree
_CorExeMain
Name
.text
Size
197KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f131ed3f634405ae488ed4164f8e3d856bb55a71764a0cbe16f42230fc3283a5.exe
- IMPHASH 42a881513039e37416778f46caf53ae1
- SHA256 f131ed3f634405ae488ed4164f8e3d856bb55a71764a0cbe16f42230fc3283a5
- MD5 6001560e7fcf13eb1f1f4eeaaf7799cf
- SHA1 569f6b1e40d83946db3594d604155bbc9240852d
- SHA512 4b9fa3d8e3db988c9e96dad0b61e0b354cb98d3d381fe61dbf67de9e3e8fb7b7bb0052fb97c846803b74bffab9107963691bdc6b4e5030b711a17e2c31d37be9
- SSDEEP 3072:HwtrEMpgVttttfDKbQygut+qzTx8hmmFanM4UOYpExCO/Qzz8EZ:H+PKNDpG+qhaaM4yExCO/Qf8EZ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
14:4b:83:57:83:da:b8:cb:01:c2:f9:5c:3a:a2:05:10:0c:f4:3b:df:58:49:cb:f1:74:fd:c1:2d:11:4d:b6:93
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US
Chains
Jan 27, 2023
CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US
Serial Number
08:00:ee:4e:d1:a9:59:cc:98:87:e9:05:ad:66:2b:fe
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 26, 2022 - Mar 1, 2023
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Minor OS version
0
Major OS version
5
Entry point
36720
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
VirtualAlloc
LockResource
LoadResource
SizeofResource
FindResourceW
GetModuleHandleW
LoadLibraryA
CreateMutexA
GetModuleHandleA
FreeConsole
GetProcAddress
VirtualProtect
lstrlenW
Sleep
CreateThread
GetLastError
WaitForSingleObject
RtlUnwind
RaiseException
GetCommandLineA
HeapAlloc
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
user32
CharToOemBuffW
gdi32
SetTextColor
CreateFontIndirectA
SelectObject
SetBkMode
advapi32
RegDeleteKeyA
Name
.text
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=20, id=149, productName=VS2008 build 21022, version=21022,
count=90, id=131, productName=VS2008 build 21022, version=21022,
count=39, id=132, productName=VS2008 build 21022, version=21022,
count=6, id=123, productName=VS2005 build 50727, version=50727,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=91, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
fc1b0f044807d4f0f7d3c68c1adb2f38da0f8a577e11322102559b6467c1fd21.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fc1b0f044807d4f0f7d3c68c1adb2f38da0f8a577e11322102559b6467c1fd21
- MD5 6c209163f8881e51e553f6c1b306d645
- SHA1 9e6692f04c6ce18c4b95e9614b26dcbd47099de7
- SHA512 d70905196a6c3d3ef3ac8d6a234c94733ce513d127a3b9edf141fa8267d90d811dbadc4a6aca5f135a3e71f21881007e422c8616a577327c00aa6b8d30064fa0
- SSDEEP 3072:oGlXG5eobrf35GO002X9CHWAhCr6m/bYQu5UwOl3xd:IxbrfcO002X9CHWAhCr6m/bYQu5UwOl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
151753
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Agniane.pdb
mscoree
_CorExeMain
Name
.text
Size
140KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ