agentx-windows-amd64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
agentx-windows-amd64.zip
Size 6.4MB
Sample261104-s9phcssxew
SHA256 4ed4b0e6051d4afba198ea2b9db9934ca84745fbabd5f53ac2d371d58bedbfd6
MD5 5f46c790e2a5971ceb80bdea4da3731e
SHA1 7aeede32a35e31c920910f2acf6c25f943ebb13a
SHA512 fb646a4ab5f88357d1bd9b92de439b2b69bc86af4aae279c983e23efdd63d9086f066ab25cd84bc91a494618d45b25b99dcb850f0bf32b766a254a1f76e3f104
SSDEEP 196608:uLPIwjkiluItSvrB9VixQ0N0m8k2wSHePk/Ui56iPOgv6T6Q:uLQI/lJSjB3ixQ0mLHt56ijvE6Q
TLSH
T11A6633617293902B7808C86FA71962DF6A1514BE987CFDCB61F2A3590F5D8CCA843DCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/agentx.exe

File Explorer

agentx-windows-amd64.zip

.zip 6.4MB
agentx.exe

.exe 15.9MB

agentx-windows-amd64.zip

SHA256 4ed4b0e6051d4afba198ea2b9db9934ca84745fbabd5f53ac2d371d58bedbfd6
MD5 5f46c790e2a5971ceb80bdea4da3731e
SHA1 7aeede32a35e31c920910f2acf6c25f943ebb13a
SHA512 fb646a4ab5f88357d1bd9b92de439b2b69bc86af4aae279c983e23efdd63d9086f066ab25cd84bc91a494618d45b25b99dcb850f0bf32b766a254a1f76e3f104
SSDEEP 196608:uLPIwjkiluItSvrB9VixQ0N0m8k2wSHePk/Ui56iPOgv6T6Q:uLQI/lJSjB3ixQ0mLHt56ijvE6Q
TLSH
T11A6633617293902B7808C86FA71962DF6A1514BE987CFDCB61F2A3590F5D8CCA843DCD
MD5 SHA1 SHA512 SSDEEP TLSH

agentx.exe

IMPHASH b196866f0bf37f1f128fa153413b744f
SHA256 9ba372ef921f78eb204a998398eb7f64ac34f76ec90fb56b5539029666054d44
MD5 dcb48893e4d7795b87f6a83201439ecf
SHA1 811c78f7c560a012e9a76e71fcfa9be4ecb1d2b4
SHA512 1b0ada0e08fa3259ebef70726c1354e8cffca9800074274285e1c0b16d95625796629ec906ca6234394634b0ddc007583134a507b6dade8bf5eae6c95bbf7278
SSDEEP 98304:RwSlLJ/iDtUC8Ew2kKEFZFVl2BY2+eLRrS8G8LuJT4NLke4Fy8Ez:RzGUCHw2kKAoi8LvL0E
TLSH
T189F63A43E8A541E4C0AAD679C67A9153BB717C895F3023D36F60F6642F36BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

537184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

511KB

Virtual Size

884KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

agentx-windows-amd64.zip

agentx.exe

kernel32

generic