flyagent | 4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4

Sharing

Copy URL Twitter E-mail

General

Target
4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4
Size 1.1MB
Sample260511-laf9dad16s
SHA256 4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4
MD5 bc33a14529e15076490e3248cc2304ad
SHA1 beb399228a200ba218c52ef96cc91ffcd7f0628b
SHA512 69d53603c989627a757c546293b12eddd5f5ca3ebe9f0cf2d0acbe6e30ea1675c26bd7b4e27daa284bd8d446ba8e64d33691e03438574f218f96acca44a06631
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qj:acallSllG4ZM7QzM2
TLSH
T1BA458D13F292C0F1E61C227124FB6739BE749B450A71CAC7E794DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 1 IoCs

resource	yara_rule
sample	flyagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4

File Explorer

4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4

.exe 1.1MB

4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4

IMPHASH f9579da8fe119702b03c99a224958463
SHA256 4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4
MD5 bc33a14529e15076490e3248cc2304ad
SHA1 beb399228a200ba218c52ef96cc91ffcd7f0628b
SHA512 69d53603c989627a757c546293b12eddd5f5ca3ebe9f0cf2d0acbe6e30ea1675c26bd7b4e27daa284bd8d446ba8e64d33691e03438574f218f96acca44a06631
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qj:acallSllG4ZM7QzM2
TLSH
T1BA458D13F292C0F1E61C227124FB6739BE749B450A71CAC7E794DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects FlyAgent Backdoor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

730710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

midiStreamOut midiOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose waveOutGetNumDevs waveOutPrepareHeader waveOutOpen midiOutUnprepareHeader midiStreamOpen midiStreamProperty midiStreamStop midiOutReset midiStreamClose midiStreamRestart

ws2_32

socket htonl bind htons WSAAsyncSelect closesocket send select WSACleanup gethostbyname inet_ntoa inet_addr gethostname ntohs getsockname sendto recvfrom ioctlsocket connect recv listen getpeername accept __WSAFDIsSet shutdown WSAStartup WSAGetLastError

rasapi32

RasHangUpA RasGetConnectStatusA

kernel32

GetFileSize GetCurrentProcess TerminateProcess OpenProcess GetWindowsDirectoryA GetSystemDirectoryA SetLastError QueryPerformanceFrequency QueryPerformanceCounter GetTimeZoneInformation SetFilePointer SetSystemPowerState FileTimeToSystemTime IsDBCSLeadByte lstrcmpA lstrcmpiA lstrcpynA FileTimeToDosDateTime FileTimeToLocalFileTime GetFileInformationByHandle GetFileType MapViewOfFile CreateFileMappingA DuplicateHandle UnmapViewOfFile SystemTimeToFileTime GetLocalTime DosDateTimeToFileTime SetFileTime RaiseException GetSystemTime RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom SetEndOfFile UnlockFile LockFile FlushFileBuffers LocalFree InterlockedDecrement InterlockedIncrement CreateToolhelp32Snapshot Process32First Process32Next TerminateThread CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW RemoveDirectoryA GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GetDriveTypeA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock InterlockedExchange GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA MoveFileA DeleteFileA CopyFileA CreateDirectoryA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress GetDiskFreeSpaceA MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle HeapSize GetACP SetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr GetVersion

user32

CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ChildWindowFromPointEx ScreenToClient GetMessagePos SetWindowRgn DestroyAcceleratorTable GetWindow GetActiveWindow SetFocus IsIconic PeekMessageA SetMenu GetMenu DeleteMenu GetSystemMenu DefWindowProcA LoadStringA GetSysColorBrush ClientToScreen EnableMenuItem GetSubMenu GetDlgCtrlID CreateAcceleratorTableA CreateMenu ModifyMenuA AppendMenuA CreatePopupMenu DrawIconEx CreateIconFromResource CreateIconFromResourceEx RegisterClipboardFormatA SetRectEmpty DispatchMessageA GetMessageA WindowFromPoint DrawFocusRect DrawEdge DrawFrameControl TranslateMessage ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect LoadIconA IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow GetMenuCheckMarkDimensions GetMenuState SetMenuItemBitmaps CheckMenuItem MoveWindow IsDialogMessageA ScrollWindowEx GetClassInfoA SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA GetMenuItemCount GetMenuItemID SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA RemovePropA GetMessageTime GetLastActivePopup RegisterWindowMessageA GetWindowPlacement GetNextDlgTabItem EndDialog CreateDialogIndirectParamA DestroyWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics IsClipboardFormatAvailable EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle IsZoomed PostQuitMessage CopyAcceleratorTableA GetKeyState TranslateAcceleratorA IsWindowEnabled ShowWindow GetKeyboardLayout GetDesktopWindow GetClassNameA keybd_event mouse_event GetWindowThreadProcessId FindWindowA UnregisterClassA GetDlgItem GetWindowTextA EnumWindows GetForegroundWindow ExitWindowsEx SetWindowTextA CharUpperA CallWindowProcA CreateWindowExA RegisterHotKey UnregisterHotKey SystemParametersInfoA LoadImageA EnumDisplaySettingsA InflateRect VkKeyScanExA GetWindowTextLengthA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA

gdi32

LineTo MoveToEx ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx SetWindowOrgEx ScaleViewportExtEx GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn PathToRegion EndPath ExtSelectClipRgn GetWindowOrgEx GetViewportOrgEx GetWindowExtEx GetDIBits RealizePalette SelectPalette StretchBlt CreatePalette CreateDIBitmap DeleteObject SelectClipRgn CreatePolygonRgn GetClipRgn SetStretchBltMode CreateRectRgnIndirect SetBkColor CreateFontA TranslateCharsetInfo SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetTextColor SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC GetViewportExtEx PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextMetricsA DPtoLP LPtoDP Rectangle Ellipse CreateCompatibleDC BitBlt StartPage StartDocA DeleteDC EndDoc EndPage GetObjectA GetStockObject CreateFontIndirectA CreateSolidBrush FillRgn CreateRectRgn CombineRgn PatBlt CreatePen SelectObject CreateBitmap CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode BeginPath GetSystemPaletteEntries GetROP2

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegQueryValueExA RegOpenKeyExA RegSetValueExA RegCreateKeyA RegQueryValueA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegCloseKey

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA DragQueryFileA ShellExecuteA DragFinish DragAcceptFiles

ole32

CLSIDFromProgID OleRun CoCreateInstance CLSIDFromString OleUninitialize OleInitialize

oleaut32

UnRegisterTypeLi LoadTypeLi LHashValOfNameSys RegisterTypeLi SafeArrayPutElement SafeArrayCreate SafeArrayDestroy SysAllocString VariantInit VariantCopyInd SafeArrayGetElement SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetDim SafeArrayGetLBound SafeArrayGetUBound VariantChangeType VariantClear

comctl32

ImageList_Add ImageList_BeginDrag ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_EndDrag ord17

wininet

InternetCanonicalizeUrlA InternetCrackUrlA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetConnectA InternetSetOptionA InternetOpenA InternetCloseHandle InternetReadFile

comdlg32

ChooseColorA GetFileTitleA GetSaveFileNameA GetOpenFileNameA