Trojan.Agent.GDD
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 23,912 |
| Threat Level: | 80 % (High) |
| First Seen: | August 22, 2025 |
| Last Seen: | November 6, 2026 |
| OS(es) Affected: | Windows |
Trojan.Agent.GDD is a Windows Trojan that the feed rates at a danger level of 8 out of 10. Like most Trojans, it pretends to be harmless or hides itself, then runs quietly in the background while performing harmful actions. This article explains what is known about it and how to reduce your risk.
Table of Contents
What Trojan.Agent.GDD does
According to the feed description, Agent.GDD runs silently in the background and carries out malicious functions. After installation it may give attackers complete control over the infected system. It may also covertly delete files and install additional malware. The description in the feed is cut off, so further behavior is not confirmed here.
Technical data from the analyzed sample shows a 32-bit (x86) native Windows executable, not a .NET application. It is a GUI application, so it can run without showing a console window. The file is not packed, but it has high entropy, no version information, no digital signature and no debug information. Missing version info and signatures are common in malicious files, though they are not proof of malice on their own.
In the analysis, 501 blocks were examined. Of these, 125 were flagged as potentially malicious, 376 were whitelisted and none were unknown. One file modification was recorded in the user's Downloads folder, and the only API category noted was user data access. This is a limited picture, and the detection count in the feed is just 1, so it should not be read as a full profile of the threat.
How it usually gets onto computers
The feed says Agent.GDD installs itself stealthily, most often by:
- exploiting system vulnerabilities and security flaws;
- software downloads from malicious websites;
- email attachments from untrusted sources, usually .exe, .pif, .avi and even .jpg files.
Files with double meanings or disguised extensions are a typical trick. A file that looks like a picture or video may actually be an executable program.
Risks for the user
If a system is infected, the risks described in the feed include:
- remote control of your computer by attackers;
- deletion of your files;
- installation of further malware.
Trojans of this type commonly lead to stolen personal data, stolen account credentials or a computer being used for other criminal activity. The feed does not confirm these specific outcomes for Agent.GDD, so treat them as typical risks of the category rather than proven behavior.
Signs of infection
Because the Trojan is designed to be silent, obvious symptoms may be absent. The feed does not list specific symptoms, but typical signs of a Trojan infection include:
- unexpected slowdowns or high resource use;
- files going missing or changing without explanation;
- unfamiliar programs or processes appearing;
- settings changing on their own;
- unusual network activity or security tools being disabled.
An unknown file in your Downloads folder that you did not knowingly save may also be a warning sign.
How to stay protected
- Keep Windows and all installed programs updated, since the Trojan is said to exploit system vulnerabilities.
- Download software only from official, trusted sources and avoid unknown websites.
- Do not open attachments from senders you do not know, especially .exe or .pif files, or media and image files that behave strangely.
- Enable file extension display in Windows so disguised files are easier to spot.
- Use a reputable, up-to-date security tool to scan your system regularly.
- Keep backups of important files on a separate drive or service that is not always connected.
If you suspect an infection, disconnect the computer from the internet, run a full scan, and change important passwords from a clean device. If the computer holds sensitive data, consider professional help to make sure the system is fully cleaned.
Analysis Report
General information
| Family Name: | Trojan.Agent.GDD |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
e2cc65db170c25641bcff50cec580c9d
SHA1:
6d7b7bc0437d90c355237f76e6088cb7df593eeb
SHA256:
D110D6F6E54425DA013D36196E438AB9CE72FC9DD8D95FA76D9B2DBB826484BE
File Size:
442.37 KB, 442368 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show 2 more
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- HighEntropy
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 501 |
|---|---|
| Potentially Malicious Blocks: | 125 |
| Whitelisted Blocks: | 376 |
| Unknown Blocks: | 0 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\downloads\matrix.uc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| User Data Access |
|
