AegisShell[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AegisShell.exe
Size 4.7MB
Sample260809-3ehrfach92
SHA256 cb53a147ce93dbe5c7bb9a583d66a9f285906b89e21af6db57cdec57e384c729
MD5 9cc758d9f97a8ec1fd62efb586ea909d
SHA1 a6676892c3d21feaa2115e02d004f141b29643b9
SHA512 658543dcc2c91f26a2f5c3a1452146b16c4a1ca7bef9db4450b0266619516015075729176d39b6bc2bad2833d535820867a3db14cab80f45d38392955f42d277
SSDEEP 49152:MbD0l4QnjVwG4SzvBJtd0EY7Lgx+//UZIRIW5bJT7OIuT7eT7e9bVroKJeq048gb:a+Rw7SzvX/yUU/UbD8ER
TLSH
T1BA367D02B75ADAADC01BC470835692735A26B0CB0F35A9FF55C855383F6AAF05F38369
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AegisShell.exe

File Explorer

AegisShell.exe

.exe 4.7MB

AegisShell.exe

IMPHASH c887b61d6b923e58db3f4fd22040b418
SHA256 cb53a147ce93dbe5c7bb9a583d66a9f285906b89e21af6db57cdec57e384c729
MD5 9cc758d9f97a8ec1fd62efb586ea909d
SHA1 a6676892c3d21feaa2115e02d004f141b29643b9
SHA512 658543dcc2c91f26a2f5c3a1452146b16c4a1ca7bef9db4450b0266619516015075729176d39b6bc2bad2833d535820867a3db14cab80f45d38392955f42d277
SSDEEP 49152:MbD0l4QnjVwG4SzvBJtd0EY7Lgx+//UZIRIW5bJT7OIuT7eT7e9bVroKJeq048gb:a+Rw7SzvX/yUU/UbD8ER
TLSH
T1BA367D02B75ADAADC01BC470835692735A26B0CB0F35A9FF55C855383F6AAF05F38369
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2450064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

aegis_shell.pdb

user32

CreateDesktopW SwitchDesktop CloseDesktop RegisterHotKey GetMessageW UnregisterHotKey OpenDesktopW RemovePropW CallWindowProcW SetForegroundWindow GetPropW SetPropW CloseClipboard GetRawInputData RegisterClipboardFormatW SetClipboardData GetClipboardData IsClipboardFormatAvailable OpenClipboard EmptyClipboard MapVirtualKeyW FlashWindowEx SendInput SetCursorPos GetSystemMenu EnableMenuItem ClientToScreen RegisterRawInputDevices GetKeyboardLayout GetAsyncKeyState IsProcessDPIAware SetWindowLongW GetWindowLongW AdjustWindowRectEx GetClipCursor EnumDisplayMonitors ClipCursor MonitorFromPoint SetWindowTextW ShowCursor RegisterWindowMessageA ShowWindow SetCapture GetClassInfoExW GetClassNameW SetTimer GetForegroundWindow GetDC ReleaseCapture CreateIcon CreateIconFromResourceEx KillTimer DestroyIcon SystemParametersInfoA SendMessageW GetActiveWindow SetCursor LoadCursorW GetMonitorInfoW MonitorFromWindow GetCursorPos TrackMouseEvent CloseTouchInputHandle GetTouchInputInfo MonitorFromRect ScreenToClient GetMenu ValidateRect GetWindowRect DispatchMessageW TranslateMessage SetWindowPlacement GetWindowPlacement PeekMessageW ChangeDisplaySettingsExW RedrawWindow DefWindowProcW SetWindowLongPtrW GetWindowLongPtrW ReleaseDC InvalidateRgn SetWindowPos GetClientRect SetWindowDisplayAffinity IsIconic GetWindowTextLengthW RegisterTouchWindow GetSystemMetrics CreateWindowExW RegisterClassExW PostMessageW DestroyWindow GetKeyState ToUnicodeEx MapVirtualKeyExW GetKeyboardState GetWindowTextW

kernel32

HeapAlloc GetProcessIoCounters GetSystemTimes GetExitCodeProcess GetProcessTimes LocalFree VirtualQueryEx HeapFree GetProcessHeap ReadProcessMemory OpenProcess GetCurrentThreadId CreateFileW GetCurrentProcessId K32GetPerformanceInfo GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime InitializeSListHead CreateProcessW GetModuleHandleA Sleep CloseHandle SetUnhandledExceptionFilter LoadLibraryW WaitForMultipleObjects GetModuleHandleW GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode GlobalLock GlobalAlloc SetLastError GetModuleFileNameW GlobalUnlock WriteConsoleW GlobalSize WideCharToMultiByte LoadLibraryExW GlobalFree MultiByteToWideChar GetCurrentThread FreeLibrary ReleaseMutex GetProcAddress CreateMutexA WaitForSingleObjectEx SwitchToThread ExitProcess FindClose FindFirstFileExW lstrlenW LoadLibraryA GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx GetStdHandle GetEnvironmentStringsW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess GetOverlappedResult ReadFile ReadFileEx CreateThread GetLastError QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime LoadLibraryExA CreateEventW WaitForSingleObject SetThreadErrorMode FormatMessageW SetFileInformationByHandle GetFullPathNameW SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

pdh

PdhGetFormattedCounterValue PdhOpenQueryA PdhCollectQueryData PdhAddEnglishCounterW PdhCloseQuery PdhRemoveCounter

powrprof

CallNtPowerInformation

ole32

RegisterDragDrop OleInitialize RevokeDragDrop CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SysStringLen SysAllocStringLen SetErrorInfo SysFreeString SafeArrayPutElement GetErrorInfo SafeArrayCreateVector

advapi32

GetTokenInformation OpenProcessToken IsValidSid ImpersonateAnonymousToken GetLengthSid CopySid RevertToSelf

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile NtQuerySystemInformation NtCreateNamedPipeFile NtQueryInformationProcess NtOpenFile RtlGetVersion

psapi

GetProcessMemoryInfo GetModuleFileNameExW

shell32

CommandLineToArgvW DragFinish DragQueryFileW

gdi32

SwapBuffers SetPixelFormat DeleteObject ChoosePixelFormat DescribePixelFormat GetDeviceCaps CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow

opengl32

wglMakeCurrent wglDeleteContext wglGetCurrentDC wglShareLists wglGetCurrentContext wglCreateContext wglGetProcAddress

shlwapi

AssocQueryStringW

uiautomationcore

UiaGetReservedNotSupportedValue UiaLookupId UiaReturnRawElementProvider UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaHostProviderFromHwnd

uxtheme

SetWindowTheme

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmAssociateContextEx ImmGetContext ImmGetCompositionStringW ImmReleaseContext

vcruntime140

memmove __CxxFrameHandler3 memcmp memset _CxxThrowException __C_specific_handler memcpy __current_exception_context __current_exception

api-ms-win-crt-math-l1-1-0

cbrtf __setusermatherr atan2f cosf roundf _hypotf fmod sin cos trunc floor sinf expf ceilf acosf exp2f round floorf powf

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

exit _exit _seh_filter_exe __p___argc _initterm_e __p___argv _cexit _c_exit _set_app_type strerror _initterm _initialize_onexit_table _register_onexit_function _get_initial_narrow_environment _initialize_narrow_environment _crt_atexit _configure_narrow_argv _register_thread_local_exe_atexit_callback terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale