flyagent | 1895b530d8dede5071ad2c00447eddbff0d57a91fc4f6568f6eaa73633f729cf

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1895b530d8dede5071ad2c00447eddbff0d57a91fc4f6568f6eaa73633f729cf.exe
Size 1.1MB
Sample260425-kf2ltscs7x
SHA256 1895b530d8dede5071ad2c00447eddbff0d57a91fc4f6568f6eaa73633f729cf
MD5 35eb6a22838b2efcda5d5e70ec696be9
SHA1 c43a794ac5792f4857f3f1496883d20e68b507e8
SHA512 aa869926330574532c43ccc37cb8ad3db11bd43e43198a4545d2ef32c07436dc0448a657c9758af78a83ab38d8f0843ef63ddc5eab02392a90ffaee18503e724
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfkiu5DM:acallSllG4ZM7QfMW
TLSH
T11B458C13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 2 IoCs

resource	yara_rule
behavioral1/memory/2512-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral1/memory/2512-1-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4764	2512	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1895b530d8dede5071ad2c00447eddbff0d57a91fc4f6568f6eaa73633f729cf.exe

C:\Users\Admin\AppData\Local\Temp\1895b530d8dede5071ad2c00447eddbff0d57a91fc4f6568f6eaa73633f729cf.exe
"C:\Users\Admin\AppData\Local\Temp\1895b530d8dede5071ad2c00447eddbff0d57a91fc4f6568f6eaa73633f729cf.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 564
  2⤵
  - Program crash
  PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2512 -ip 2512
1⤵
PID:1044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2512-1-0x0000000000400000-0x000000000055F000-memory.dmp