ClientAgent (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ClientAgent (1).exe
Size 7.9MB
Sample261002-y96drst1ct
SHA256 c78cc6201afc194eab718b337ba6f7d4e49a14871eeb2f39e5c9005138f6f226
MD5 be9595d36156a075a9c36ebabd5ddfa7
SHA1 ff45348738b9cb6305fc8d571f699e2560f421c3
SHA512 d010fb2697ae5310eefc90a185cab6dc16f85ec9467e1d986d100925390176317a74063b06fc13548651532e8957ea3936c34ee85fbf291764d03fc94b0894bb
SSDEEP 196608:q/+3HxMfPbf5klnKaanGzHKccWxIcoUDhtClTk5EhA:z3R8r50ynGzHmoXUTfm
TLSH
T15086339CC5D60A05C7ADC23DD43F7BB4ADEA74F26B6B9AEFE3A14461C40217607EA044
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ClientAgent (1).exe

File Explorer

ClientAgent (1).exe

.exe 7.9MB

ClientAgent (1).exe

IMPHASH 369f6896ebcd6aebcf8632766b29556b
SHA256 c78cc6201afc194eab718b337ba6f7d4e49a14871eeb2f39e5c9005138f6f226
MD5 be9595d36156a075a9c36ebabd5ddfa7
SHA1 ff45348738b9cb6305fc8d571f699e2560f421c3
SHA512 d010fb2697ae5310eefc90a185cab6dc16f85ec9467e1d986d100925390176317a74063b06fc13548651532e8957ea3936c34ee85fbf291764d03fc94b0894bb
SSDEEP 196608:q/+3HxMfPbf5klnKaanGzHKccWxIcoUDhtClTk5EhA:z3R8r50ynGzHmoXUTfm
TLSH
T15086339CC5D60A05C7ADC23DD43F7BB4ADEA74F26B6B9AEFE3A14461C40217607EA044
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4726356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

sendto getsockopt recv recvfrom connect socket send shutdown select bind getnameinfo freeaddrinfo getaddrinfo ntohl htons htonl ntohs WSAPoll closesocket ioctlsocket getservbyname getservbyport gethostbyname gethostbyaddr inet_ntoa inet_addr getpeername WSASetLastError WSASocketA setsockopt listen getsockname accept WSAIoctl WSACleanup WSAStartup WSAGetLastError

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptGetProperty BCryptDecrypt BCryptDestroyKey

ole32

CoTaskMemFree CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoCreateGuid CoCreateFreeThreadedMarshaler CoUninitialize CoCreateInstance StringFromGUID2

oleaut32

GetErrorInfo SysStringLen VariantClear SysAllocString SysFreeString VariantInit SetErrorInfo

kernel32

CreateEventW SetEvent RtlUnwind SetEndOfFile HeapSize GetProcessHeap GetOEMCP IsValidCodePage HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW HeapFree GetConsoleOutputCP HeapAlloc GetCommandLineW GetCommandLineA SetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW GetTimeZoneInformation UnhandledExceptionFilter IsDebuggerPresent RtlCaptureContext IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW WakeConditionVariable InitOnceBeginInitialize InitOnceComplete GetLogicalProcessorInformationEx SwitchToThread WaitForSingleObjectEx GetTickCount64 TryAcquireSRWLockExclusive OutputDebugStringA RtlCaptureStackBackTrace GetModuleHandleW SetUnhandledExceptionFilter GetModuleFileNameW SetInformationJobObject AssignProcessToJobObject SetEnvironmentVariableW CreateJobObjectW GetEnvironmentVariableW GetTempPathW GetFileAttributesW FreeEnvironmentStringsW ResumeThread OpenProcess SetFileAttributesW CopyFileW GetEnvironmentStringsW Sleep ExitProcess ReadFile GetFileSizeEx WriteFile CreateFileW CloseHandle SetFilePointerEx FlushFileBuffers QueryFullProcessImageNameW GetComputerNameW GlobalMemoryStatusEx GetTickCount GetSystemDirectoryW LocalFree GetComputerNameExA GetComputerNameA VirtualProtect VirtualFree GetCurrentProcess VirtualAlloc FlushInstructionCache GlobalAlloc GlobalFree SetHandleInformation CreatePipe GetCurrentThreadId MultiByteToWideChar EnterCriticalSection GetStdHandle LeaveCriticalSection InitializeCriticalSection WriteConsoleW DeleteCriticalSection WideCharToMultiByte GetCurrentThread GetProcAddress SleepConditionVariableCS WakeAllConditionVariable InitializeConditionVariable TryAcquireSRWLockShared GetLastError ReleaseSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive AcquireSRWLockShared InitializeSRWLock WaitForSingleObject CreateThread GetSystemTimeAsFileTime SetLastError GetCurrentProcessId GetModuleHandleExW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber GetFileType GetSystemTime SystemTimeToFileTime FindClose FindFirstFileW FindNextFileW GetSystemDirectoryA FreeLibrary LoadLibraryA FormatMessageA ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetACP RtlVirtualUnwind ConvertFiberToThread ConvertThreadToFiber TerminateProcess LoadLibraryW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW CreateMutexA ReleaseMutex GetSystemTimePreciseAsFileTime QueryPerformanceFrequency GetLocaleInfoEx RaiseException RtlPcToFileHeader GetFileInformationByHandleEx MoveFileExW CopyFile2 SleepConditionVariableSRW QueryPerformanceCounter InitializeSListHead GetStartupInfoW GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetFileAttributesExW GetFullPathNameW SetFileInformationByHandle CreateFile2 AreFileApisANSI

user32

GetWindowTextW EnumDisplayDevicesW GetForegroundWindow GetLastInputInfo GetWindowTextLengthW GetProcessWindowStation MessageBoxW GetUserObjectInformationW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

178KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

226KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rmmgd

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rmmgt

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ClientAgent (1).exe

ws2_32

bcrypt

ole32

oleaut32

kernel32

user32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic