Trojan.Agent.AIUB
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 12,416 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 85 |
| First Seen: | August 19, 2024 |
| Last Seen: | July 26, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Agent.AIUB on your system indicates a potential security threat that requires immediate attention. This type of malware is designed to compromise the integrity of your computer, steal sensitive information, or disrupt its normal functioning. It is essential to understand the nature of this threat and take prompt action to remove it and prevent future infections.
Table of Contents
What Is Trojan.Agent.AIUB?
Trojan.Agent.AIUB is a type of Trojan horse malware, which is a broad category of malicious software that disguises itself as legitimate programs. Unlike viruses, Trojans do not replicate themselves but can cause significant harm by providing unauthorized access to your system, stealing data, or installing additional malware. The name "Trojan.Agent.AIUB" suggests it is a unique variant within the Trojan category, but without more specific information, it's challenging to attribute it to a known malware family.
How Trojan.Agent.AIUB Operates
Trojan horses like Trojan.Agent.AIUB typically operate by deceiving users into installing them on their systems. This can happen through various means, such as downloading and executing files from untrusted sources, opening malicious email attachments, or visiting compromised websites. Once installed, the malware can perform a variety of malicious activities, including but not limited to, data theft, keystroke logging, and the installation of additional malware. The exact operational methods of Trojan.Agent.AIUB would depend on its specific design and the intentions of its creators.
Symptoms of Infection
Identifying a Trojan infection can be challenging because these malware types are designed to operate stealthily. However, some common symptoms may indicate the presence of malware like Trojan.Agent.AIUB on your system. These include unexpected changes to your computer settings, unfamiliar programs or icons, slow system performance, frequent crashes, or unusual network activity. If you notice any of these symptoms, it is crucial to take immediate action to scan your system and remove any detected threats.
How to Remove Trojan.Agent.AIUB
- Enter Safe Mode with Networking: Restart your computer and enter Safe Mode. This will limit the malware's ability to interfere with the removal process. Ensure you have an active internet connection to download and update removal tools.
- Conduct a Full Scan: Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system. Ensure the tool is updated with the latest definitions to effectively detect and remove Trojan.Agent.AIUB.
- Uninstall Suspicious Programs: Go through the list of installed programs on your computer and uninstall any that you do not recognize or that were installed around the time your system became infected.
- Reset Your Browser: If your web browser (such as Chrome, Firefox, or Edge) has been affected, reset it to its default settings. This can help remove any malicious extensions or settings that the malware may have installed.
- Reboot and Re-scan: After completing the above steps, reboot your computer and perform another full scan with your anti-malware tool to ensure that all components of the malware have been removed.
Conclusion
Removing Trojan.Agent.AIUB from your system requires careful and immediate action to prevent further damage. By following the steps outlined above and maintaining good computer hygiene practices, such as regularly updating your operating system and security software, being cautious with email attachments and downloads, and using strong, unique passwords, you can significantly reduce the risk of future infections. Remember, the key to protecting your digital assets is vigilance and proactive security measures.
Analysis Report
General information
| Family Name: | Trojan.Agent.AIUB |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
244d48544ef0637f81a8ab3620450321
SHA1:
25138afc217fddcfa58920e4c079ce78821ea9e5
SHA256:
497811B96925102D5536B5D9883901BAEBD19259FD58350E63F4B9AC9C62FEEC
File Size:
606.21 KB, 606208 bytes
|
|
MD5:
e5b475870874c6eb44eb8eaa97b3f4c1
SHA1:
c80cdb5dedc1f61e1705487625785506cb600fdd
SHA256:
140196CDFE4B7D87350AF22EFF055900D1FF0F421527A4FA3A5CD3B68D79F93C
File Size:
559.63 KB, 559634 bytes
|
|
MD5:
9a65661e2be8ce3914aed74b2e3c8dc5
SHA1:
5cd987b54e43b22d6a4f686a891f30f33fd4f8f3
SHA256:
AB18B90B3B3251AB6AD4C0B9E808B1AE5950CC546EBBE4D8EC0A1BAD71F6533E
File Size:
238.59 KB, 238592 bytes
|
|
MD5:
81cc280480aa0b9d64bd61a356a1815e
SHA1:
e85b7debc5140c491aef1fb870c8bf5ce3508965
SHA256:
67B3BBA54CA3963D84B829519CCDD63BBACC4458D0747CA6E82FCF28493B10CD
File Size:
538.11 KB, 538112 bytes
|
|
MD5:
daacb3bf9ca62beb72b9594bbf8c8945
SHA1:
705e916741b0765fcc1707999794ea2ddb02be92
SHA256:
217BF3100AF52CAFD4C4D9B477DD5D6D61BC6CBA04EB997BA15D2DA554122A09
File Size:
453.63 KB, 453632 bytes
|
Show More
|
MD5:
bbf9335df909f216b3b6bc395d6fad3c
SHA1:
8aad821658c003334fb264bea54cc35f1e08d6a0
SHA256:
8442D2BFC3D16EFF5158E64FA39793D7F4DE50E9ECAA42A91FBA78F166AC47B3
File Size:
450.56 KB, 450560 bytes
|
|
MD5:
adbe205db313f183d0de83d03fab2837
SHA1:
2bb396be1bbe117f5157c7d49b2d1431e138ca11
SHA256:
C63575DB675447C48BC4A39B94729DD747DBA792188B31A72CD9CA011F4E3608
File Size:
479.23 KB, 479232 bytes
|
|
MD5:
522ddec0029f5804591ed84a9076d61b
SHA1:
063e94c5ac4fd994004753a395dec4668c77a75a
SHA256:
5186DEACF361847F73FD2820A25896C6231E68324850B1D23D00314727601024
File Size:
415.74 KB, 415744 bytes
|
|
MD5:
67d3b3aa0fbd6771ebb634740fe4d1e5
SHA1:
bb5a93794344cf022266e42210cf1acf47097851
SHA256:
A17607F9334621CDD2851A53B5B86B7DB5D81B153A0FC4F7501D751F0E501F88
File Size:
493.57 KB, 493568 bytes
|
|
MD5:
e6ce623e69b7b16635b6dc2603596ea5
SHA1:
d49ce04dfcff73ba31c1b8c282f3c746e024ee5e
SHA256:
B56F07A7ED9A5F2667FC6F2D9F6305ED44C08B128C770AE859BE85BBD6EBD827
File Size:
595.97 KB, 595968 bytes
|
|
MD5:
217e45309b9d789cb14e8288f1d9ebb4
SHA1:
c1b9b168f7f6fe79444cf8144a4ace7b762677c8
SHA256:
50DE1116945A4CDDDB7777EF9E847E9BCC1734FCD56D5887C144029596514EA4
File Size:
520.70 KB, 520704 bytes
|
|
MD5:
05f38f79e9ece7814a3b74535b553a50
SHA1:
36a96563604af12ca525f7440b7f796d30a141a1
SHA256:
B6D81889433A289E38AE004817013231175A3BA65DEDAFC880E304189ECC7381
File Size:
612.35 KB, 612352 bytes
|
|
MD5:
c69855de2ea93bb19e8b3d9071a586fc
SHA1:
83612032af6f152c528d1117b7cf26eded1eb853
SHA256:
C0A41EAEC5F6C397EADDECF77D9E29AAEC4116776122549F634D64061E631001
File Size:
649.73 KB, 649728 bytes
|
|
MD5:
211bd0d2670d371b63eeb584584d6277
SHA1:
4eac13dee773d1ad3b68c5a235c597b63475f4e9
SHA256:
D0C05869CE1B27B08D58A47705DD1C34C6FBFBF20957D1442B2028B3F95AC8AB
File Size:
586.75 KB, 586752 bytes
|
|
MD5:
4bdd7c3a2c868c7e48684896c62e6161
SHA1:
bffb0687387724a0896fc289990f44725638d435
SHA256:
46755397F1610E4FB786D600FF1BC181E0909D252BFC4ADE3018A6A9C31654BF
File Size:
478.72 KB, 478720 bytes
|
|
MD5:
c79b80f9592c344343d5257d345eb287
SHA1:
340928d8107da41a7b1a3681b4167dce6d6395ff
SHA256:
61B71A301AAB0EFC760CD01EFA1780DF1387B8F78F1A8B78C840BD4CD6A23433
File Size:
487.94 KB, 487936 bytes
|
|
MD5:
e26da8f854735a26862bb16f70c63f92
SHA1:
48245f66e48d31212947e44b3114200314f0dc99
SHA256:
2A712BD47D8DEEB9118F20E316EE3E051458345DB53C67468403BAB3A25F872D
File Size:
584.70 KB, 584704 bytes
|
|
MD5:
38d523427b4d7ee62e6ef62d62a13950
SHA1:
ced277ab3d5688b8d90851e2df8cb13ead57f0ee
SHA256:
BE097A24500D8C2828AA32F9095111EE65F028F46AB5C8E41B57AF5408D60B8B
File Size:
672.77 KB, 672768 bytes
|
|
MD5:
9dc2b9ff9379c8156b89639c1f950d01
SHA1:
856d5948555318ae026f73b2df5aa409fd584db7
SHA256:
96CCD05743137BDB83B4ECD22D5BA2BF5AF3A5FC43AD6FA7B7B6CF62BB39AA81
File Size:
1.04 MB, 1040752 bytes
|
|
MD5:
ed2eb017d16a1c401336a01fc7ec688d
SHA1:
2f3ddeb7dbe325f8ea4cd62d359abb020a609ae0
SHA256:
AA15D756DE330C9B4C2F0FA9CA8D05D01169AEEE8269D3E40A89ABBDDA73EEC9
File Size:
446.46 KB, 446464 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| LENOVO (UNITED STATES) INC. | LENOVO (UNITED STATES) INC. | Self Signed |
File Traits
- 2+ executable sections
- big overlay
- dll
- HighEntropy
- ntdll
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 466 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 459 |
| Unknown Blocks: | 7 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.AN
- Agent.ANH
- Agent.IUH
- Agent.KPG
- Agent.OFGI
Show More
- Amadey.BB
- Clipbanker.DI
- Farfli.ZI
- GameHack.LPE
- Korplug.P
- Kryptik.ATAS
- Kryptik.ATAX
- Kryptik.NGE
- Kryptik.PAH
- Murphy.B
- Spy.Agent.FG
- TinyNuke.AA
- Trojan.Agent.Gen.PW
- Trojan.Agent.Gen.SX
- Trojan.Downloader.Gen.BP
- Trojan.Injector.Gen.FLI
- Trojan.Krypt.Gen.PS
- Trojan.Kryptik.Gen.DGK
- Trojan.Kryptik.Gen.DHA
- Trojan.Kryptik.Gen.EGV
- Trojan.ShellcodeRunner.Gen.CL
- Trojan.ShellcodeRunner.Gen.FF
- Trojan.ShellcodeRunner.Gen.IC
- Trojan.ShellcodeRunner.Gen.LT
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| Anti Debug |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\25138afc217fddcfa58920e4c079ce78821ea9e5_0000606208.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c80cdb5dedc1f61e1705487625785506cb600fdd_0000559634.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5cd987b54e43b22d6a4f686a891f30f33fd4f8f3_0000238592.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e85b7debc5140c491aef1fb870c8bf5ce3508965_0000538112.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\705e916741b0765fcc1707999794ea2ddb02be92_0000453632.,LiQMAxHB
|
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\8aad821658c003334fb264bea54cc35f1e08d6a0_0000450560.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\2bb396be1bbe117f5157c7d49b2d1431e138ca11_0000479232.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\063e94c5ac4fd994004753a395dec4668c77a75a_0000415744.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\bb5a93794344cf022266e42210cf1acf47097851_0000493568.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\d49ce04dfcff73ba31c1b8c282f3c746e024ee5e_0000595968.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c1b9b168f7f6fe79444cf8144a4ace7b762677c8_0000520704.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\36a96563604af12ca525f7440b7f796d30a141a1_0000612352.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\83612032af6f152c528d1117b7cf26eded1eb853_0000649728.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\4eac13dee773d1ad3b68c5a235c597b63475f4e9_0000586752.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\bffb0687387724a0896fc289990f44725638d435_0000478720.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\340928d8107da41a7b1a3681b4167dce6d6395ff_0000487936.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\48245f66e48d31212947e44b3114200314f0dc99_0000584704.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ced277ab3d5688b8d90851e2df8cb13ead57f0ee_0000672768.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\856d5948555318ae026f73b2df5aa409fd584db7_0001040752.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\2f3ddeb7dbe325f8ea4cd62d359abb020a609ae0_0000446464.,LiQMAxHB
|
