Threat Database Trojans Trojan.Agent.Gen.DAZ

Trojan.Agent.Gen.DAZ

By CagedTech in Trojans
Published:
Last updated:

Threat Scorecard

Popularity Rank: 16,607
Threat Level: 80 % (High)
Infected Computers: 3
First Seen: June 19, 2026
Last Seen: October 4, 2026
OS(es) Affected: Windows

Trojan.Agent.Gen.DAZ is a Trojan horse threat that targets Windows computers. It is classified as a high-risk infection, and once it finds its way onto a system, it works quietly in the background while carrying out harmful actions without the user's knowledge or consent. Like most threats in the Trojan.Agent.Gen family, it is a generic detection name, meaning it can cover a range of malicious files that share similar behavior rather than a single, fixed piece of malware.

Security systems have observed this threat active over several months, which shows it continues to circulate rather than being a one-time outbreak. Its executable is built as a native 64-bit Windows application, carries no digital signature, and shows no version information — all traits that are typical of malware designed to avoid easy identification and to blend in with legitimate system processes.

What Trojan.Agent.Gen.DAZ Does

Once active, Trojan.Agent.Gen.DAZ runs silently and can perform a range of damaging functions in the background. Analysis of its behavior shows that it is capable of manipulating processes and memory on the infected machine, including unmapping sections of running processes — a technique often used to inject malicious code into legitimate programs or to hide its own activity. It can also launch additional processes, write data to files, and make use of encryption routines, which may be used to disguise its network communications or the data it handles. These capabilities suggest that the Trojan could be used to download further malicious components, exfiltrate information, or give attackers a foothold for deeper control of the system.

As with many Trojans in this category, Trojan.Agent.Gen.DAZ may allow hackers to gain extensive control over an infected computer. This can include the ability to delete or modify files, steal saved passwords and other sensitive data, alter system settings, and monitor the user's activity on the device.

How It Spreads

Trojan.Agent.Gen.DAZ typically installs itself stealthily by exploiting system vulnerabilities and security flaws. It commonly spreads through software downloaded from malicious or compromised websites, as well as through email attachments sent from untrusted or spoofed sources. These attachments are often disguised as common file types, such as .exe, .pif, .avi, or even .jpg files, to trick users into opening them.

Risks for Users

The presence of this Trojan on a computer can lead to serious consequences, including loss of personal and financial data, unauthorized remote access to the system, installation of additional malware, and degraded system performance. Because it operates covertly, victims often remain unaware of the infection until damage has already been done.

Signs of Infection

Trojans like this one are built to avoid detection, so obvious symptoms may not always appear. However, users should watch for unexplained slowdowns, unfamiliar processes running in the background, unexpected network activity, changes to system settings that were not made intentionally, or the appearance of unknown programs.

How to Stay Protected

To reduce the risk of infection, avoid downloading software from untrusted websites, never open email attachments from unknown or suspicious senders, and keep the Windows operating system and installed applications fully updated to close known security gaps. Using reputable, up-to-date security software and performing regular system scans can help detect and remove threats like Trojan.Agent.Gen.DAZ before they cause serious harm.

Analysis Report

General information

Family Name: Trojan.Agent.Gen.DAZ
Signature status: No Signature

Known Samples

MD5: 09e60109dcae9093cf5c4d56beb9e523
SHA1: 7fd79d33c138914cb490b3573306b4f825296fe4
SHA256: 28BF45E2FA2A4CEC5DC3B4DB302626A3C6EA775E2A06AC2DD991423C031991A9
File Size: 31.23 KB, 31232 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have resources
  • File doesn't have security information
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
Show More
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • HighEntropy
  • No Version Info
  • x64

Block Information

Total Blocks: 17
Potentially Malicious Blocks: 10
Whitelisted Blocks: 7
Unknown Blocks: 0

Visual Map

x x x x x x 0 0 0 0 0 x 0 x 0 x x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

Registry Modifications

Key::Value Data API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 䜞ǝ RegNtPreCreateKey

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtCompareSigningLevels
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
Show More
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreatePrivateNamespace
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFlushProcessWriteBuffers
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtGetCachedSigningLevel
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTerminateProcess
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForMultipleObjects
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtYieldExecution
  • UNKNOWN
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Encryption Used
  • BCryptOpenAlgorithmProvider

Shell Command Execution

C:\WINDOWS\System32\conhost.exe "C:\WINDOWS\System32\conhost.exe" "/sihost64"