jaffacakes118_Backdoor[.]Win32[.]Agobot[.]gen[.]50dfeb018672eb0bb5726b2e815f03e8

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Backdoor.Win32.Agobot.gen.50dfeb018672eb0bb5726b2e815f03e8
Size 240KB
Sample261012-3tyffafe65
SHA256 94160d3421b5526962fd98712265d81c79a2d51e0f646667a3b87e92e20c94b6
MD5 50dfeb018672eb0bb5726b2e815f03e8
SHA1 3ff1525d292938446d10770d5a54e7753c56c10a
SHA512 bd090a44fa14cad778b4e28f20b04c6be6cc3394f125f1ba464c37ef4d27e03e708261be7fb5b59368ae3fc871461f115230e7d6e6657cbe2640c4dbee9bbd98
SSDEEP 6144:SMHGFS41JNWwuyzHfYBLvz7lDuMn0UnBYAHIP2BQgL:SM5417VuUfYFHlDuMniAHBQg
TLSH
T1C7346C3239D084B7EA530432E9D84BB9A9F1F4301B7A854367D3DF3C793B7826525A89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Backdoor.Win32.Agobot.gen.50dfeb018672eb0bb5726b2e815f03e8

File Explorer

jaffacakes118_Backdoor.Win32.Agobot.gen.50dfeb018672eb0bb5726b2e815f03e8

.exe 240KB

jaffacakes118_Backdoor.Win32.Agobot.gen.50dfeb018672eb0bb5726b2e815f03e8

IMPHASH 46ca83463834673ab85e70404535f9d9
SHA256 94160d3421b5526962fd98712265d81c79a2d51e0f646667a3b87e92e20c94b6
MD5 50dfeb018672eb0bb5726b2e815f03e8
SHA1 3ff1525d292938446d10770d5a54e7753c56c10a
SHA512 bd090a44fa14cad778b4e28f20b04c6be6cc3394f125f1ba464c37ef4d27e03e708261be7fb5b59368ae3fc871461f115230e7d6e6657cbe2640c4dbee9bbd98
SSDEEP 6144:SMHGFS41JNWwuyzHfYBLvz7lDuMn0UnBYAHIP2BQgL:SM5417VuUfYFHlDuMniAHBQg
TLSH
T1C7346C3239D084B7EA530432E9D84BB9A9F1F4301B7A854367D3DF3C793B7826525A89
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

144354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit _iob ?terminate@@YAXXZ _onexit __dllonexit ??1type_info@@UAE@XZ _endthreadex _beginthreadex _except_handler3 __CxxFrameHandler sprintf isdigit calloc fprintf printf perror _errno strerror fflush sscanf wcstombs mbstowcs wcscpy strcat toupper fputc wcscat strtok _ftol rand __p__commode fwrite fseek ftell malloc free exit strncmp atof memcmp strchr strncat system _memccpy _itoa _stricmp atoi strcpy fopen fread strcmp fclose memmove memcpy ??0exception@@QAE@ABQBD@Z ??1exception@@UAE@XZ _CxxThrowException ??0exception@@QAE@ABV0@@Z _vsnprintf strlen strncpy memset strstr ??2@YAPAXI@Z ??3@YAXPAX@Z _purecall _EH_prolog __p__fmode __set_app_type _controlfp srand _strdup

msvcp60

?_Xran@std@@YAXXZ ?_Xlen@std@@YAXXZ

kernel32

GetStartupInfoA CreateFileMappingA MapViewOfFile UnmapViewOfFile TlsGetValue SetLastError TlsFree TlsAlloc GetExitCodeThread ReleaseSemaphore CreateSemaphoreA GetCurrentProcessId SetThreadPriority RaiseException TlsSetValue DeleteCriticalSection InitializeCriticalSection WaitForMultipleObjects CreateEventA GetCurrentThreadId GetCurrentProcess GetCurrentThread DuplicateHandle InterlockedIncrement GetThreadPriority EnterCriticalSection LeaveCriticalSection ResumeThread WaitForSingleObject ResetEvent InterlockedDecrement TransactNamedPipe MultiByteToWideChar GetLastError GetSystemDirectoryA CopyFileA GetModuleFileNameA OpenProcess GetModuleHandleA FreeConsole AllocConsole GetStdHandle WriteFile CreateNamedPipeA WaitNamedPipeA CreateFileA TerminateProcess CloseHandle ReadFile GetTickCount Sleep FreeLibrary GetProcAddress LoadLibraryA DeleteFileA CreateProcessA ExpandEnvironmentStringsA GetComputerNameA GetVersionExA GlobalMemoryStatus

user32

ExitWindowsEx wsprintfA

advapi32

OpenSCManagerA RegSetValueExA RegQueryValueExA RegQueryInfoKeyA RegEnumKeyExA StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA SetServiceStatus StartServiceA OpenServiceA ControlService DeleteService RegOpenKeyExA CreateServiceA CloseServiceHandle ChangeServiceConfig2A RegDeleteValueA RegCreateKeyExA InitializeSecurityDescriptor SetSecurityDescriptorDacl GetUserNameA RegCloseKey

shell32

ShellExecuteA

ws2_32

gethostname sendto htonl setsockopt WSASocketA ntohl WSASetLastError WSAIoctl getservbyname shutdown ntohs gethostbyaddr inet_ntoa gethostbyname ioctlsocket getpeername getsockname send connect WSACleanup WSAStartup inet_addr recv WSAGetLastError select __WSAFDIsSet accept bind listen closesocket socket getsockopt htons

netapi32

NetUseDel NetApiBufferFree NetShareEnum NetUserEnum NetScheduleJobAdd NetRemoteTOD NetUseAdd

mpr

WNetAddConnection2A WNetCancelConnection2W WNetCancelConnection2A WNetAddConnection2W

psapi

EnumProcessModules EnumProcesses GetModuleBaseNameA

dnsapi

DnsQuery_A