AG_2[.]22[.]0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AG_2.22.0.exe
Size 10.4MB
Sample261011-tk815sbs8t
SHA256 cb0a5c7c77a3e24dbb4e7f696c40d2b757355d51c772ea861d7471d028307f3a
MD5 864a2628014d59cebe1e8e1070384aeb
SHA1 20ef70028e07b908a0f7f45b85028b30ce56c6a3
SHA512 f9b110683e1d452bfc198a601c2c338c3720f1e24de8169b1dd73e0004c20328b52164392ad0c268fec5ceabd673ef6f720e898b9a07b8babcaabaa8976485f8
SSDEEP 98304:OC0pEI1tSNXRJOjppHHijfJLHr4+VYRZ50NaW/bqtM8/n+:/KxTgBJYRQcZX
TLSH
T121B68E43F2D281EEC05DC4749367B633E633B8890629B2BB6BD44B102E65FA09F4D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AG_2.22.0.exe

File Explorer

AG_2.22.0.exe

.exe 10.4MB

AG_2.22.0.exe

IMPHASH 2689ab898f8a21bfc533b377fc21d625
SHA256 cb0a5c7c77a3e24dbb4e7f696c40d2b757355d51c772ea861d7471d028307f3a
MD5 864a2628014d59cebe1e8e1070384aeb
SHA1 20ef70028e07b908a0f7f45b85028b30ce56c6a3
SHA512 f9b110683e1d452bfc198a601c2c338c3720f1e24de8169b1dd73e0004c20328b52164392ad0c268fec5ceabd673ef6f720e898b9a07b8babcaabaa8976485f8
SSDEEP 98304:OC0pEI1tSNXRJOjppHHijfJLHr4+VYRZ50NaW/bqtM8/n+:/KxTgBJYRQcZX
TLSH
T121B68E43F2D281EEC05DC4749367B633E633B8890629B2BB6BD44B102E65FA09F4D759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6826464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ag_unlocker.pdb

ws2_32

WSAGetLastError closesocket WSASocketW connect WSAPoll getsockopt recv bind listen sendto ioctlsocket setsockopt accept select WSAStartup WSACleanup shutdown WSADuplicateSocketW recvfrom WSASend send getaddrinfo freeaddrinfo

kernel32

GetStringTypeW GetFileType SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage SwitchToThread GetSystemTimePreciseAsFileTime GetCurrentProcessId CloseHandle LoadLibraryA GetProcAddress WaitForSingleObject GetLastError GetExitCodeProcess CompareStringOrdinal AttachConsole FreeConsole AllocConsole CreateFileW SetStdHandle SetConsoleTitleW CreateConsoleScreenBuffer GetStdHandle GetLocalTime TerminateProcess SetLastError OpenProcess QueryFullProcessImageNameW RemoveDirectoryW GetSystemFirmwareTable FindClose AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc LocaleNameToLCID GlobalUnlock GlobalAlloc GlobalLock GlobalSize WideCharToMultiByte MultiByteToWideChar GlobalFree WaitForMultipleObjects GetNumberOfConsoleInputEvents ReadConsoleInputW SetConsoleCursorInfo SetConsoleCursorPosition FillConsoleOutputCharacterA FillConsoleOutputAttribute GetConsoleScreenBufferInfo GetConsoleMode SetConsoleMode SetConsoleActiveScreenBuffer SetConsoleTextAttribute GetCurrentThreadId FreeLibrary CreateWaitableTimerExW SetWaitableTimer FormatMessageW LoadLibraryExW LoadLibraryW SetThreadErrorMode Sleep GetModuleHandleA RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW CreateMutexA ReleaseMutex RtlVirtualUnwind GetCurrentDirectoryW GetConsoleOutputCP WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx QueryPerformanceFrequency GetModuleHandleW QueryPerformanceCounter SetHandleInformation CreateThread GetFullPathNameW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetCommandLineW GetTempPathW DeleteFileW CopyFileExW MoveFileExW FindNextFileW SetFilePointerEx CreateEventA RemoveVectoredExceptionHandler LoadLibraryExA VirtualProtect CompareStringW LCMapStringW FlushFileBuffers HeapSize GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader WriteFile GetModuleHandleExW GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter

advapi32

RegGetValueW SystemFunction036 RevertToSelf ImpersonateAnonymousToken

iphlpapi

GetExtendedTcpTable GetExtendedUdpTable GetBestInterface

user32

GetWindowTextLengthW GetWindowTextW FlashWindowEx CreateIconIndirect GetWindowPlacement GetClassNameW GetClassInfoExW GetMonitorInfoW GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo DestroyCursor DestroyIcon SystemParametersInfoA RegisterWindowMessageA MonitorFromPoint EnumDisplayMonitors ShowWindow GetSystemMenu EnableMenuItem SetWindowLongW ChangeDisplaySettingsExW SetWindowPlacement LoadCursorW SetCursor GetCursorPos ReleaseCapture MonitorFromWindow GetRawInputData ValidateRect MapVirtualKeyW GetWindowLongW GetMenu AdjustWindowRectEx TrackMouseEvent ScreenToClient GetTouchInputInfo CloseTouchInputHandle DestroyWindow SetCapture GetWindowRect GetClipCursor ClipCursor ShowCursor MapVirtualKeyExW GetKeyState GetKeyboardState IsIconic SendInput SetForegroundWindow SetWindowDisplayAffinity RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware GetDC CreateIcon InvalidateRgn SetWindowPos RegisterRawInputDevices CreateWindowExW GetWindowLongPtrW GetClientRect GetSystemMetrics RemovePropW SetWindowLongPtrW SetPropW IsWindowVisible SendMessageW PostMessageW SetWindowTextW GetActiveWindow SetCursorPos ToUnicodeEx GetKeyboardLayout GetWindowThreadProcessId GetForegroundWindow CloseClipboard RegisterClipboardFormatW GetClipboardData IsClipboardFormatAvailable OpenClipboard EmptyClipboard SetClipboardData CallWindowProcW RegisterClassExW RedrawWindow TranslateMessage DispatchMessageW PeekMessageW MsgWaitForMultipleObjectsEx CreateIconFromResourceEx MonitorFromRect DefWindowProcW ClientToScreen MessageBoxW ReleaseDC GetPropW

shell32

DragQueryFileW ord680 ShellExecuteW SHGetKnownFolderPath DragFinish

ole32

CoUninitialize CoCreateFreeThreadedMarshaler RegisterDragDrop OleInitialize RevokeDragDrop CoInitializeEx CoCreateInstance CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

shlwapi

AssocQueryStringW

ntdll

NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError NtReadFile NtWriteFile

oleaut32

GetErrorInfo SysAllocStringLen SafeArrayCreateVector SafeArrayPutElement SysStringLen SysFreeString SetErrorInfo VariantClear

uiautomationcore

UiaLookupId UiaGetReservedNotSupportedValue UiaGetReservedMixedAttributeValue UiaHostProviderFromHwnd UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaReturnRawElementProvider

gdi32

CreateRectRgn SetBitmapBits CreateCompatibleBitmap DeleteObject GetDeviceCaps CreateBitmap SwapBuffers ChoosePixelFormat DescribePixelFormat SetPixelFormat

dxgi

CreateDXGIFactory1

setupapi

SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW

bcryptprimitives

ProcessPrng

opengl32

wglMakeCurrent wglGetCurrentContext wglGetCurrentDC wglCreateContext wglShareLists wglGetProcAddress wglDeleteContext

imm32

ImmSetCandidateWindow ImmAssociateContextEx ImmGetContext ImmReleaseContext ImmGetCompositionStringW ImmSetCompositionWindow

bcrypt

BCryptGenRandom

uxtheme

SetWindowTheme

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

Name

.text

Size

6.8MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AG_2.22.0.exe

ws2_32

kernel32

advapi32

iphlpapi

user32

shell32

ole32

api-ms-win-core-synch-l1-2-0

shlwapi

ntdll

oleaut32

uiautomationcore

gdi32

dxgi

setupapi

bcryptprimitives

opengl32

imm32

bcrypt

uxtheme

dwmapi

generic