AgtaBackup RAT Campaign

Domains/URLs

avanade.cc

backupplanetwealthagta.top

beehstwithust.org

blessingsbe.top

bootbackup.com

bootprivate.com

cashyejrudga.live

childofwhho.top

connectprivae.top

criopifileeworking.top

datavaseffhjurd.top

electomm.sbs

emef.info

emsafetoproceedtaward.top

evobasin.info

ghxstworkingagent.top

greateshystfqsh.one

gsop.top

hr4hire.top

installapp.cc

jokermav.online

kresyuhjance.help

llgoldassociates.com

magicislanding.lol

outfitstryon.info

palnetworkingleup.top

piejaholoop.org

planetbizzingupcleananddirt.top

planetvocalfortesttheteas.cyou

planetvocalfortheteas.cyou

planetwealthonlycleancoffe.top

planetwealthonlycleantea.top

planetworkingclassrewor.top

planetworkingfortwo.top

planetwrokingclassforagemt.top

plnetcorresnifagenttea.top

qualityfilesghost.live

redjohntiger.top

rizkidworikingjuice.top

runtownagtabackup.top

selfpnl001.com

sunbeitnetwork.com

unrealjustcoffe.top

unrelioaworkinghun.top

acrobat-reader-installer.com

03webzoominvite.us

/AgtaBackupAgent.version

/AgtaBackupAgent.msi

/api/agents/browser-profile

/api/agents/checkin

/api/agents/install-stage/{id}

/api/agents/result

/ws/agent?id={agentId}&secret={secret}

Hash

10e0a4861b94b72dd802d0a59f2eac7f8df63f497460aa5252560951fe7b8614

2be4a7b66f6e2fc6759451861ca36589ab6d41566c33226dcac80da15862299d

5c3267a7855efc96c1144cbfcee937527979d4747c7645b2d36958d43ef3d51f

a30e8229085407db5ddfe58d33cd7dc4d70fdd0eec29ae0714d77762bbf61393

c9394752d42fe7b70aa65d91802d4d2a0365c885f27db07460f724395f53ab70

cfdd8d82fa71383c9ed92d1c21dd64b0eda3d8bb622d71be7205802269fe8e58

Filenames

C:\Program Files\Agta Backup

C:\Program Files\Agta CS Test

C:\ProgramData\Agta Backup

C:\ProgramData\Agta CS Test

C:\Windows\SystemTemp\agta_av_*.ps1

C:\Windows\SystemTemp\agta_task_*.xml

C:\Windows\Temp\agta-install.log

C:\Windows\Temp\AgtaBackupAgent.msi

AgtaBackupAgent.msi

Credential Guard.exe

Dell Window Guard.exe

Dell.sub.Agent.exe

Dell.Virus.Guard.exe

Window Security Health Services.exe

Detection Query 1 :

domainname like "jokermav.online" or url like "jokermav.online" or siteurl like "jokermav.online" or domainname like "hr4hire.top" or url like "hr4hire.top" or siteurl like "hr4hire.top" or domainname like "kresyuhjance.help" or url like "kresyuhjance.help" or siteurl like "kresyuhjance.help" or domainname like "beehstwithust.org" or url like "beehstwithust.org" or siteurl like "beehstwithust.org" or domainname like "blessingsbe.top" or url like "blessingsbe.top" or siteurl like "blessingsbe.top" or domainname like "planetvocalfortheteas.cyou" or url like "planetvocalfortheteas.cyou" or siteurl like "planetvocalfortheteas.cyou" or domainname like "emsafetoproceedtaward.top" or url like "emsafetoproceedtaward.top" or siteurl like "emsafetoproceedtaward.top" or domainname like "electomm.sbs" or url like "electomm.sbs" or siteurl like "electomm.sbs" or domainname like "childofwhho.top" or url like "childofwhho.top" or siteurl like "childofwhho.top" or domainname like "criopifileeworking.top" or url like "criopifileeworking.top" or siteurl like "criopifileeworking.top" or domainname like "planetvocalfortesttheteas.cyou" or url like "planetvocalfortesttheteas.cyou" or siteurl like "planetvocalfortesttheteas.cyou" or domainname like "cashyejrudga.live" or url like "cashyejrudga.live" or siteurl like "cashyejrudga.live" or domainname like "avanade.cc" or url like "avanade.cc" or siteurl like "avanade.cc" or domainname like "sunbeitnetwork.com" or url like "sunbeitnetwork.com" or siteurl like "sunbeitnetwork.com" or domainname like "connectprivae.top" or url like "connectprivae.top" or siteurl like "connectprivae.top" or domainname like "selfpnl001.com" or url like "selfpnl001.com" or siteurl like "selfpnl001.com" or domainname like "emef.info" or url like "emef.info" or siteurl like "emef.info" or domainname like "redjohntiger.top" or url like "redjohntiger.top" or siteurl like "redjohntiger.top" or domainname like "outfitstryon.info" or url like "outfitstryon.info" or siteurl like "outfitstryon.info" or domainname like "planetwealthonlycleancoffe.top" or url like "planetwealthonlycleancoffe.top" or siteurl like "planetwealthonlycleancoffe.top" or domainname like "03webzoominvite.us" or url like "03webzoominvite.us" or siteurl like "03webzoominvite.us" or domainname like "qualityfilesghost.live" or url like "qualityfilesghost.live" or siteurl like "qualityfilesghost.live" or domainname like "datavaseffhjurd.top" or url like "datavaseffhjurd.top" or siteurl like "datavaseffhjurd.top" or domainname like "llgoldassociates.com" or url like "llgoldassociates.com" or siteurl like "llgoldassociates.com" or domainname like "plnetcorresnifagenttea.top" or url like "plnetcorresnifagenttea.top" or siteurl like "plnetcorresnifagenttea.top" or domainname like "planetworkingclassrewor.top" or url like "planetworkingclassrewor.top" or siteurl like "planetworkingclassrewor.top" or domainname like "evobasin.info" or url like "evobasin.info" or siteurl like "evobasin.info" or domainname like "installapp.cc" or url like "installapp.cc" or siteurl like "installapp.cc" or domainname like "acrobat-reader-installer.com" or url like "acrobat-reader-installer.com" or siteurl like "acrobat-reader-installer.com" or domainname like "planetwrokingclassforagemt.top" or url like "planetwrokingclassforagemt.top" or siteurl like "planetwrokingclassforagemt.top" or domainname like "gsop.top" or url like "gsop.top" or siteurl like "gsop.top" or domainname like "bootbackup.com" or url like "bootbackup.com" or siteurl like "bootbackup.com" or domainname like "planetworkingfortwo.top" or url like "planetworkingfortwo.top" or siteurl like "planetworkingfortwo.top" or domainname like "greateshystfqsh.one" or url like "greateshystfqsh.one" or siteurl like "greateshystfqsh.one" or domainname like "magicislanding.lol" or url like "magicislanding.lol" or siteurl like "magicislanding.lol" or domainname like "planetbizzingupcleananddirt.top" or url like "planetbizzingupcleananddirt.top" or siteurl like "planetbizzingupcleananddirt.top" or domainname like "unrelioaworkinghun.top" or url like "unrelioaworkinghun.top" or siteurl like "unrelioaworkinghun.top" or domainname like "rizkidworikingjuice.top" or url like "rizkidworikingjuice.top" or siteurl like "rizkidworikingjuice.top" or domainname like "palnetworkingleup.top" or url like "palnetworkingleup.top" or siteurl like "palnetworkingleup.top" or domainname like "backupplanetwealthagta.top" or url like "backupplanetwealthagta.top" or siteurl like "backupplanetwealthagta.top" or domainname like "unrealjustcoffe.top" or url like "unrealjustcoffe.top" or siteurl like "unrealjustcoffe.top" or domainname like "bootprivate.com" or url like "bootprivate.com" or siteurl like "bootprivate.com" or domainname like "piejaholoop.org" or url like "piejaholoop.org" or siteurl like "piejaholoop.org" or domainname like "runtownagtabackup.top" or url like "runtownagtabackup.top" or siteurl like "runtownagtabackup.top" or domainname like "ghxstworkingagent.top" or url like "ghxstworkingagent.top" or siteurl like "ghxstworkingagent.top" or domainname like "planetwealthonlycleantea.top" or url like "planetwealthonlycleantea.top" or siteurl like "planetwealthonlycleantea.top" or domainname like "/AgtaBackupAgent.version" or siteurl like "/AgtaBackupAgent.version" or url like "/AgtaBackupAgent.version" or domainname like "/AgtaBackupAgent.msi" or siteurl like "/AgtaBackupAgent.msi" or url like "/AgtaBackupAgent.msi" or domainname like "/api/agents/browser-profile" or siteurl like "/api/agents/browser-profile" or url like "/api/agents/browser-profile" or domainname like "/api/agents/checkin" or siteurl like "/api/agents/checkin" or url like "/api/agents/checkin" or domainname like "/api/agents/install-stage/{id}" or siteurl like "/api/agents/result" or url like "/api/agents/result" or domainname like "/ws/agent?id={agentId}&secret={secret}" or siteurl like "/ws/agent?id={agentId}&secret={secret}" or url like "/ws/agent?id={agentId}&secret={secret}"

Detection Query 2 :

sha256hash IN ("2be4a7b66f6e2fc6759451861ca36589ab6d41566c33226dcac80da15862299d","cfdd8d82fa71383c9ed92d1c21dd64b0eda3d8bb622d71be7205802269fe8e58","5c3267a7855efc96c1144cbfcee937527979d4747c7645b2d36958d43ef3d51f","10e0a4861b94b72dd802d0a59f2eac7f8df63f497460aa5252560951fe7b8614","a30e8229085407db5ddfe58d33cd7dc4d70fdd0eec29ae0714d77762bbf61393","c9394752d42fe7b70aa65d91802d4d2a0365c885f27db07460f724395f53ab70")

Detection Query 3 :

resourcename = "Windows Security" AND eventtype = "4663" AND (objectname like "C:\Program Files\Agta Backup" or objectname like "C:\Program Files\Agta CS Test" or objectname like "C:\ProgramData\Agta Backup" or objectname like "C:\ProgramData\Agta CS Test" or objectname like "C:\Windows\SystemTemp\agta_av_*.ps1" or objectname like "C:\Windows\SystemTemp\agta_task_*.xml" or objectname like "C:\Windows\Temp\agta-install.log" or objectname like "C:\Windows\Temp\AgtaBackupAgent.msi" or objectname like "AgtaBackupAgent.msi" or objectname like "Credential Guard.exe" or objectname like "Dell Window Guard.exe" or objectname like "Dell.sub.Agent.exe" or objectname like "Dell.Virus.Guard.exe" or objectname like "Window Security Health Services.exe")

Detection Query 4 :

Technologygroup = “EDR” AND (objectname like "C:\Program Files\Agta Backup" or objectname like "C:\Program Files\Agta CS Test" or objectname like "C:\ProgramData\Agta Backup" or objectname like "C:\ProgramData\Agta CS Test" or objectname like "C:\Windows\SystemTemp\agta_av_*.ps1" or objectname like "C:\Windows\SystemTemp\agta_task_*.xml" or objectname like "C:\Windows\Temp\agta-install.log" or objectname like "C:\Windows\Temp\AgtaBackupAgent.msi" or objectname like "AgtaBackupAgent.msi" or objectname like "Credential Guard.exe" or objectname like "Dell Window Guard.exe" or objectname like "Dell.sub.Agent.exe" or objectname like "Dell.Virus.Guard.exe" or objectname like "Window Security Health Services.exe")