General

  • Target
    WonRemote-Agent-Update.exe
  • Size 28.3MB
  • Sample261110-1tpgesdw2v
  • SHA256 387063f08e1cf63e9ddea8fa74e73e17b56741e78d91d4b4768017ad3ced3306
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • WonRemote-Agent-Update.exe
    .exe 28.3MB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/agent-file-update.ps1
    .ps1 5KB
  • $PLUGINSDIR/nsExec.dll
    .dll 7KB
  • $PLUGINSDIR/payload/agent-update-health.ps1
    .ps1 3KB
  • $PLUGINSDIR/payload/agent/index.mjs
    .js 3.7MB
  • $PLUGINSDIR/payload/bin/vcruntime140.dll
    .dll 120KB
  • $PLUGINSDIR/payload/bin/wonremote-poc.exe
    .exe 2.7MB
  • $PLUGINSDIR/payload/icons/agent.ico
    6KB
  • $PLUGINSDIR/payload/icons/viewer.ico
    6KB
  • $PLUGINSDIR/payload/manage-agent-firewall.ps1
    .ps1 1KB
  • $PLUGINSDIR/payload/manage-agent-login-task.ps1
    .ps1 23KB
  • $PLUGINSDIR/payload/node_modules/node-datachannel/package.json
    189B
  • $PLUGINSDIR/payload/runtime/node.exe
    .exe 61.3MB
  • $PLUGINSDIR/payload/server/index.mjs
    .js 85KB
  • $PLUGINSDIR/payload/update-handoff-broker.ps1
    .ps1 1KB
  • $PLUGINSDIR/payload/wonremote-viewer.exe
    .exe 6.2MB
  • $PLUGINSDIR/stop-wonremote-processes.ps1
    .ps1 5KB

WonRemote-Agent-Update.exe

  • IMPHASH 46ce5c12b293febbeb513b196aa7f843
  • SHA256 387063f08e1cf63e9ddea8fa74e73e17b56741e78d91d4b4768017ad3ced3306
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
14020
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths