Trojan.Agent.AAQC
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,685 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 667 |
| First Seen: | December 9, 2023 |
| Last Seen: | April 22, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Agent.AAQC |
|---|---|
| Packers: | $Id: UPX |
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
42d5190bce7951f57db4168c9ec51561
SHA1:
a2c610538ceea99181c3b959811204d61fcea1ab
File Size:
4.10 MB, 4101104 bytes
|
|
MD5:
72723a03918c01490cd149cf2d1037ed
SHA1:
1fbcbf1649d97b663bdd550119a12fc445b7bdcb
SHA256:
F0319A687F56AEB2BE028D94E5EA1CF3CC20F6DD337EDB9B84712DFF5A23C0C9
File Size:
2.61 MB, 2607778 bytes
|
|
MD5:
4281d11424d9cbd2ec9d8ec1f35acfc7
SHA1:
a55339b46133cde377870aab47474b5dcd981cb5
SHA256:
B62E2ED41039854592ADCE190DD245F1031C5552C305D1F08A9DB75FA3CA48B8
File Size:
20.03 KB, 20027 bytes
|
|
MD5:
7a882d62c6f10a45097f39deecb98e7d
SHA1:
2083ca37e51110d6eb90eca8045499475de3c2b3
SHA256:
0F4DCE55281E1CCAD71CB3CF202F056497853421A40E021C2FEE3AF1092CEFA7
File Size:
1.23 MB, 1230352 bytes
|
|
MD5:
cfb5d58bdef6d86ad8cde9ed2da16f6c
SHA1:
0a671b8506bec367a263ee28b2f63de6c1d813f8
SHA256:
14617644EB3B599532A35313BACD04F46BB3DAD2731F4CD8E7080C572FB36920
File Size:
571.56 KB, 571564 bytes
|
Show More
|
MD5:
43656fc5c8b0d5b96555f04d79389af3
SHA1:
5e3577215add40d19115c76cd5baf00e21c54fad
SHA256:
0E71BBFA86FC2B4A6121E191B880A7AC4F51BA3E7A89ADB0F5D6E58D41D03B6D
File Size:
651.20 KB, 651200 bytes
|
|
MD5:
da66cad5c4e8adcac931374567cd8c5f
SHA1:
5ab96a537a28e5aec732f4819b11ed9f58072be8
SHA256:
8F35411A9812903DB2B7A25B142D8BCF69F26E41F6BFDD889851806B12BE235F
File Size:
18.60 KB, 18596 bytes
|
|
MD5:
5d02e7e6a4d2825e4ba7b737288913d7
SHA1:
992d1aa683127c3d1bd69a6d353095a6ca91af69
SHA256:
98353CC890F59D3F097ABBA14A7989BD6A4B615472181D855E134232D76F8F0B
File Size:
3.68 MB, 3684512 bytes
|
|
MD5:
cf65d6e766b0eef29e74b8d956afd7af
SHA1:
05813af1d8a83335320cb9f2924fbd12a4efa932
SHA256:
D45178642364F2C6DA0BFB917671DEEA5CB0FBFF8E0EBB6398BF001F50C5EBE5
File Size:
8.20 MB, 8201142 bytes
|
|
MD5:
f2a244dc8b21583ee38642d0759f2783
SHA1:
b5abb887f29efa2a5a008a8330eebe01b5dce189
SHA256:
B6C15F465C1ED1D3E83616B49BF388C2A0A25EABA24F0C481C29B866978B8B85
File Size:
1.23 MB, 1234740 bytes
|
|
MD5:
23bc4af1466b1ab8776260c210327e7e
SHA1:
953783dd6a09d688d4240f23b9ac1dd4ee29f8f6
SHA256:
325E38F03082BD937C0E51F124E9D564D44C8F404EA56663FE6BF30C3BA760B8
File Size:
3.81 MB, 3809189 bytes
|
|
MD5:
278ecc6e14b0290f22525cca0b70be28
SHA1:
8677c5341afb813d86f372f7477051cb71d74a06
SHA256:
97C57963884157A8FF682C7D7BE41974DB21C45C1A4133C35F9FEE35081AADBC
File Size:
19.59 KB, 19592 bytes
|
|
MD5:
4d500bcb360443a32015b091a8c8dfa2
SHA1:
41cfaf7c0e63263399f6d8e90b06567bab5a9d52
SHA256:
1EF14D762CB8BFFA521E6B82374BAC0460EFBE644F405DDF1E50825B118EA583
File Size:
283.06 KB, 283057 bytes
|
|
MD5:
81d1fc98f6f8741129c2f5d3c9064a7c
SHA1:
28f306d0550f6094105f5e199e5d0f7882e2206d
SHA256:
0DF5B1FDC53B00DFEBA3C0F84E8D24653532AA0C72C9597069AC5D151E56960D
File Size:
3.49 MB, 3490786 bytes
|
|
MD5:
0b1ae487e7adf835b3ceea6d4683175b
SHA1:
4c82172a735c5d6712fa3b8f8ecfc858a261fbc4
SHA256:
3C395078BD9C89CF7BAB7FD4597075FD58719741FFC1FB9126C6F82C051B238E
File Size:
6.35 MB, 6351455 bytes
|
|
MD5:
57e6aa9595546dedf5d8a043c17a2302
SHA1:
01526bdf7b271dff75cde003e25c85d60f16d637
SHA256:
EDAF8400E317D0D08A6082762148EA529BA39B842BEBDA5A156D9BCDCC1A7237
File Size:
1.20 MB, 1198163 bytes
|
|
MD5:
b009059e5ba804766a2f983f920bc4fd
SHA1:
6b79b7402ff1894fd556fe68103ad6598049d86e
SHA256:
4B59BCF94A20AB3952E9CB2F5FCD8EEA258ACEE1BECDD0722192473D66F32E76
File Size:
1.16 MB, 1157303 bytes
|
|
MD5:
de192e77cf7722c8cc338c4ebabd1a1b
SHA1:
4a724a8fda6c3158ad0d4c845804e63877b3d476
SHA256:
2E225B9C75AB1F2DF143CC717CC880046D90A7802315101DE9D654701A6F1B3D
File Size:
6.19 MB, 6192565 bytes
|
|
MD5:
0f86ace34095e68ed218527a11b5d9ca
SHA1:
43127bb81640fb6339eae58d57b0fe0f7c1609f1
SHA256:
7EE541D92EBB036B1202D60A6828D2C9A6039B9CD6237A9EE31B5731253CE708
File Size:
51.54 KB, 51536 bytes
|
|
MD5:
af9284d49425f2a2115a99763989a186
SHA1:
176080205f59db6583d48c473bf55b7211cf2f16
SHA256:
01E369B104C69F4239A4BE6950E1472D075BBF258712A0DDD848D368BE7D04F2
File Size:
140.02 KB, 140020 bytes
|
|
MD5:
f10ca79b0cad9483a7fa198ffb9b1841
SHA1:
c455546190ed66bc524935d6f5ac10e84d81327a
SHA256:
6A2A1377BA73A811F0C5F1AA7BDF31F448572DAD70582D759D41934E37EF29F3
File Size:
189.30 KB, 189298 bytes
|
|
MD5:
5bb20b23008c365c620fefaeeed3815f
SHA1:
4b06f0572fba629b563f3da32f98e518daf2d029
SHA256:
19CB7E4EC336A208AF06B2DA3227EA59C60F6D282E0E7301EAC38C5A7D7089BD
File Size:
1.19 MB, 1193752 bytes
|
|
MD5:
225c2f52f8a768d653cd2b7ed1962607
SHA1:
2789df6c5b68c2c9ebbf779d1f21e87de58ac350
SHA256:
8D9EA95DB2DFD008CCAF4C6E7533B9AF0CDBD49CE27B41FA919EA7D78F68FEDB
File Size:
1.45 MB, 1447664 bytes
|
|
MD5:
f08bdd8551714a8128a2fb6bcc0f4db0
SHA1:
c53c59af8a9bbb37c0f45358f333f7671cc85758
SHA256:
9273DB0321294560F5B7776D5C02E35FE650FA2D52DF60AC6D12FF311F00A025
File Size:
394.62 KB, 394625 bytes
|
|
MD5:
99e4002e5050d34c983bba4008c5142b
SHA1:
645a7e8622ad58c192c31d3c82a565f69b73628d
SHA256:
5514DB80D9849F4D6AB5C6266DEDDCCBA2D946197134DF186DFCC2D63E0D0E02
File Size:
219.81 KB, 219809 bytes
|
|
MD5:
4a821c87c3cf6fec59bb1dd88ac01750
SHA1:
5b178cc709a8f6494cb9d666d9e054232d8fffbb
SHA256:
7B37D9C6816B16C0B8804692DCD7526439BFC2C5BF8BAB40892BB55A07633B2F
File Size:
1.46 MB, 1457664 bytes
|
|
MD5:
bc03adb9bc919de37fc914259a4341fb
SHA1:
53d068c4063baffa8b354626692fd04a946867b5
SHA256:
0A37FF231D0A6DF1DA9217DAE3B409440A8F1E22CA2EC4D48B89CFDD2F17A0A1
File Size:
1.44 MB, 1438591 bytes
|
|
MD5:
8088b2aec28b3bf889b9d669f3e14f1d
SHA1:
84f66a4fc845a8871307b4621d6771a5d5999dc8
SHA256:
3DE3386F9DBD9BFF95F84B0C13DA70CB7B458D849F1A3BB9D8AF8EE8EE1A4143
File Size:
8.62 MB, 8616028 bytes
|
|
MD5:
89cf9b4ee4acc2e641394a9ffbf58391
SHA1:
4b345383e9c186873859f6b3184d997c3f023c20
SHA256:
92640D4D08FF587229B105B3882C5FA5948A9BC8769E4C75A4411BDF52AD4707
File Size:
1.62 MB, 1620245 bytes
|
|
MD5:
eba22c9923283450e754351832051e98
SHA1:
4ec04bb0d2fb425c1a1e75be059254c85b2e6110
SHA256:
41FBDB2572423E10BDA3473D18A42FE49BDC6AE4FCCF803EF53BE348DF319A60
File Size:
8.58 MB, 8576937 bytes
|
|
MD5:
28d916a8c5ecdcd7de81f24e292b6382
SHA1:
655e578c94653bca175c9cf6a64f39ac80da0799
SHA256:
60C03922F43A8E1518DE2F6DBA1DD9209BDAD87D7D6D1C5DD20AA5ACB7BDEB8C
File Size:
995.98 KB, 995977 bytes
|
|
MD5:
72f03fcc2844500791f86ff1fbb3741d
SHA1:
6fa32cd090fd856e1405e520a00ae4f5860ed237
SHA256:
F132DAF39C112C81E05233D9D7FC2FB309B018F7A6EDB26DB0301C23608E6379
File Size:
5.39 MB, 5391478 bytes
|
|
MD5:
0c44ede974841b339f9a7cc26d4587c8
SHA1:
2069f753c4f91081fd5ed3ec66de0790b923ffb9
SHA256:
7B116972EFAE6ED98B517E8C032AFD90A0A48979CB74CFF45D0FB1527E60A442
File Size:
1.28 MB, 1279518 bytes
|
|
MD5:
8e704057209a26c25e1a3effd46a8ee6
SHA1:
a77d3fde71cf1243b3d51d5b9e4f565f20e3d1eb
SHA256:
4627EED8C32CDFA3AE3455F41323B55833EED77EAA6D8E71969E21AF69864246
File Size:
1.22 MB, 1222603 bytes
|
|
MD5:
4c059b7b9072e8b0555ad2ea55f02528
SHA1:
9b0ff53d626706639047f09ac48454d93f980a67
SHA256:
9800E6D6A8E4753335B758ACC9A4F375E3A10EDF465E0F2DAC84E17B79B29184
File Size:
96.10 KB, 96098 bytes
|
|
MD5:
28ec43efc8fd914ac2469f6b48e1ebe0
SHA1:
ff6440e98a8b5acb833f675889100f76dc43a6d3
SHA256:
D6F546C0F9D6BE0C3164E52758A0D153D7D05F2A28B2F500396825CE146B381C
File Size:
9.74 MB, 9742914 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- $Id: UPX
- .UPX
- 2+ executable sections
- HighEntropy
- No Version Info
- packed
- RAR (In Overlay)
- RARinO
- upx
- UPX!
Show More
- WinZip SFX
- x86
- ZIP (In Overlay)
- ZIPinO
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 132 |
|---|---|
| Potentially Malicious Blocks: | 105 |
| Whitelisted Blocks: | 27 |
| Unknown Blocks: | 0 |
Visual Map
0
x
x
0
0
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
0
0
x
0
x
x
x
x
x
0
x
0
0
x
0
0
x
0
x
x
x
x
x
x
x
x
0
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
0
x
x
x
x
x
x
x
0
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
0
1
x
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.AAQC
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
