flyagent | b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 21:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe
Size 1.4MB
Sample260416-1gz3dset91
SHA256 b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b
MD5 8f7250509593661419c02b1b999122fa
SHA1 fcb862437eb70c50c5cfc5ebb36d60e5e58d6579
SHA512 87bc5b871f628a88bfe1863714adecf2ba580e978e383491cb70391739db4ee5fa81b3a3e5317ac5f0f7de604a6d3dd42af5ce4b01a57f4e367b9accb6244610
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QS:GcallSllG4ZM7QzMx
TLSH
T104658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 2 IoCs

resource	yara_rule
behavioral1/memory/556-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral1/memory/556-11-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
556	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe
556	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe
556	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe
556	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
556	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
556	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe
556	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2144	556	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe	87
PID 556 wrote to memory of 4872	556	b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe	86

C:\Users\Admin\AppData\Local\Temp\b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe
"C:\Users\Admin\AppData\Local\Temp\b6d30fb4024f649955dea51ec2ab7274f48ffe32484f3575afe510b5c479c30b.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4872
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 55ca618a929341d8fcceff626b05b25915aaf5b7e701674c0ec013aa4638e416
MD5 2e25a0aa351a3b4b53f20d06b78c0f2f
SHA1 387a5b7db2a33486a0dca292bfb90575552ed988
SHA512 f9370c0bd570a16d0bed8b84a656b6cf8f4a103d690418b158fe75f716dcbbf7bc2a26df2db1103a45a3e45513410940fa817b1ced26e8b79ea518d6ff496609
TLSH
T14801CB10ED8CC21D507A53762572E44EF7EA1453A303ACE8B995D5622FB07689CB4A37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/556-11-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/556-12-0x0000000000B20000-0x0000000000B45000-memory.dmp

Download

memory/2144-14-0x0000000002980000-0x00000000029E3000-memory.dmp

Download

memory/4872-13-0x00000000034F0000-0x0000000003553000-memory.dmp

Download