Trojan.Agent.FDIB
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 8,404 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 23 |
| First Seen: | July 15, 2025 |
| Last Seen: | July 9, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Agent.FDIB indicates that your system has been compromised by a potentially malicious program. This type of threat is known as a Trojan, which is a broad category of malware that can perform a variety of functions, including data theft, system compromise, and unauthorized access. It's essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.
Table of Contents
What Is Trojan.Agent.FDIB?
Trojan.Agent.FDIB is a type of malware that can infect your system through various means, such as exploited vulnerabilities, phishing attacks, or drive-by downloads. Once inside, it can establish a connection with its command and control server, allowing attackers to remotely control your system, steal sensitive information, or use your system as a botnet to conduct further malicious activities. The "Agent" part of the name suggests that it may be designed to operate stealthily, gathering intelligence or performing specific tasks without being detected.
How Trojan.Agent.FDIB Operates
Upon infection, Trojan.Agent.FDIB can create a backdoor on your system, allowing attackers to access your files, passwords, and other sensitive data. It may also modify system settings, disable security software, or create new user accounts with administrative privileges. This type of malware can be particularly dangerous as it can lead to identity theft, financial loss, or even ransomware attacks. It's crucial to note that Trojan.Agent.FDIB may not exhibit obvious symptoms, making it challenging to detect without proper security tools and expertise.
Symptoms of Infection
While Trojan.Agent.FDIB may not always display noticeable symptoms, some common signs of infection include slow system performance, frequent crashes, or unusual network activity. You may also notice unfamiliar programs or toolbars installed on your system, or your browser may be redirected to suspicious websites. Additionally, you may receive alerts from your security software or notice that your system is behaving erratically. If you suspect that your system has been infected, it's essential to take immediate action to remove the malware and prevent further damage.
How to Remove Trojan.Agent.FDIB
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for a more effective removal process.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of Trojan.Agent.FDIB.
- Uninstall any suspicious programs or applications that may be related to the malware infection.
- Reset your browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
- Reboot your system and perform another full scan to ensure that the malware has been completely removed.
Conclusion
Removing Trojan.Agent.FDIB requires a combination of technical expertise and the right security tools. By following the steps outlined above, you can help ensure that your system is free from this potentially malicious program. However, it's essential to remain vigilant and take proactive measures to prevent future infections, such as keeping your operating system and software up-to-date, using strong antivirus software, and avoiding suspicious downloads or email attachments. Remember, the key to protecting your system and data is to stay informed and take immediate action when a threat is detected.
Analysis Report
General information
| Family Name: | Trojan.Agent.FDIB |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
2c584009702f5d52eacadfe137503906
SHA1:
0f4a88c79a461d9c4aa79b250e7afe54e43e0f61
SHA256:
D3EC5ADC00254B61525E8B923801AA123FA4B5B55B7453793AC370F84A958F60
File Size:
345.60 KB, 345600 bytes
|
|
MD5:
05d3ed8c6355ad23db6bc87429b805ae
SHA1:
76e0559f59b769e865d51df00aa475fc5d79b75a
SHA256:
9B494BE540E289A56717BBF6B65CF2E44FF37F54FBB25568AC9FBE45D3E316C4
File Size:
346.62 KB, 346624 bytes
|
|
MD5:
7368d691cca297067070d7da303a1288
SHA1:
343352dff529a219728b3829ea122d51309a34aa
SHA256:
37B9F7CB40587556556B91A1FE57C075FF1C0816FE99DF3B0E3F4AD3B18EAB0E
File Size:
346.62 KB, 346624 bytes
|
|
MD5:
4c1240caacf03fe53f06648d82cf4181
SHA1:
544be476a687ec29793d8775a3c9c6fcc56e858d
SHA256:
E918E96B8B32028DFD4D2EA058BEA5AFD3008BB5901E72BD016D5E47BD1D57D0
File Size:
358.91 KB, 358912 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | vorpX |
| File Description | vorpX Virtual Display Installer |
| File Version |
|
| Internal Name | vorpVirtualDisplayInstall.exe |
| Legal Copyright | Copyright (C) 2025 |
| Original Filename | vorpVirtualDisplayInstall.exe |
| Product Name | vorpX |
| Product Version |
|
File Traits
- Installer Version
- No Version Info
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,214 |
|---|---|
| Potentially Malicious Blocks: | 28 |
| Whitelisted Blocks: | 1,163 |
| Unknown Blocks: | 23 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Gamehack.GSI
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 苎뜖쯪ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c cls
|
