Benign Download

Backdoor.Win32.Agent.ako

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256ff9fc71cdc6e387312b150581b6fe57d7572e06cb0521fa6651832a3f2d9895a

Evidence

Query/set system parameters (string) 0x6cff6–0x6d096

0x6cff66765000000005472616e736c6174654dge....TranslateM
0x6d0064449537973416363656c000000005472DISysAccel....Tr
0x6d01661636b506f7075704d656e7500000000ackPopupMenu....
0x6d02653797374656d506172616d6574657273SystemParameters
0x6d036496e666f4100000053686f7757696e64InfoA...ShowWind
0x6d0466f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x6e47c–0x6e56c

0x6e47cb636be36c636ce36d636de36e636ee36.6.6.6.6.6.6.6.6
0x6e48cf636fe3606370e3716371e3726372e37.6.6.7.7.7.7&7.7
0x6e49c36373e3746374e3756375e3766376e3767>7F7N7V7^7f7n7
0x6e4ac76377e3786378e3796379e37a637ae37v7~7.7.7.7.7.7.7
0x6e4bcb637be37c637ce37d637de37e637ee37.7.7.7.7.7.7.7.7
⋯11 more rows

Execute shell command (ShellExecuteA) 0x6e650–0x6e830

⋯13 more rows
0x6e7209033943398339c33a033a433a833b633.3.3.3.3.3.3.3.3
0x6e730c833e833f033f433f833fc3300340434.3.3.3.3.3.3.4.4
0x6e74008340c3410341c343c34443448344c34.4.4.4.4<4D4H4L4
0x6e7505034543458345c346034643478349834P4T4X4\4`4d4x4.4
⋯3 more rows
0x6e7905c356035643568356c35703574358435\5`5d5h5l5p5t5.5
0x6e7a0a435ac35b035b435b835bc35c035c435.5.5.5.5.5.5.5.5
0x6e7b0c835cc35e43504360c36103614361836.5.5.5.6.6.6.6.6
0x6e7c01c362036243628362c363c365c366436.6 6$6(6,6<6\6d6
⋯7 more rows