flyagent | 58d20d4dd2f3f7108469442c32f61d084e023fa0aa27cddf05701622018f2a85

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 13:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
58d20d4dd2f3f7108469442c32f61d084e023fa0aa27cddf05701622018f2a85.exe
Size 1.1MB
Sample261011-qz1frsbs8q
SHA256 58d20d4dd2f3f7108469442c32f61d084e023fa0aa27cddf05701622018f2a85
MD5 c8061b9691d3ef65e98926f3e948efb0
SHA1 e9f4aef05147d6627714f251f9255f426ed52b3b
SHA512 aaeac175932970f53eddf3d97c4797d92ab4d44abaecf8eccdb9abe23cba43f96a8c5cc106fd9f40ec3baae28eeb0dabaaaf7ad04db45c1d7b878a87df1561fe
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7QJkiu5/M:acallSllG4ZM7QJMm
TLSH
T130458C13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 2 IoCs

resource	yara_rule
behavioral1/memory/1720-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral1/memory/1720-1-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4144	1720	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58d20d4dd2f3f7108469442c32f61d084e023fa0aa27cddf05701622018f2a85.exe

C:\Users\Admin\AppData\Local\Temp\58d20d4dd2f3f7108469442c32f61d084e023fa0aa27cddf05701622018f2a85.exe
"C:\Users\Admin\AppData\Local\Temp\58d20d4dd2f3f7108469442c32f61d084e023fa0aa27cddf05701622018f2a85.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 564
  2⤵
  - Program crash
  PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1720 -ip 1720
1⤵
PID:972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1720-1-0x0000000000400000-0x000000000055F000-memory.dmp