Trojan.Agent.KB

The detection of Trojan.Agent.KB on your system indicates a potential security threat that requires immediate attention. This type of malware is designed to compromise the security and integrity of your computer, and it's essential to understand its nature and take steps to remove it.

What Is Trojan.Agent.KB?

Trojan.Agent.KB is a type of Trojan horse malware that can infect your computer without your knowledge or consent. The name "Trojan" refers to the fact that this type of malware disguises itself as a legitimate program or file, allowing it to bypass security measures and gain access to your system. The ".KB" suffix may indicate a specific variant or identifier, but it's not a known malware family. Trojan horses like Trojan.Agent.KB can be used to steal sensitive information, install additional malware, or provide unauthorized access to your computer.

How Trojan.Agent.KB Operates

Once Trojan.Agent.KB infects your computer, it can operate in various ways, depending on its intended purpose. It may attempt to connect to a command and control server to receive instructions or transmit stolen data. It can also install additional malware or create backdoors to allow other malicious programs to enter your system. Trojan horses often exploit vulnerabilities in software or operating systems, which is why it's crucial to keep your system and applications up to date.

Symptoms of Infection

The symptoms of a Trojan.Agent.KB infection can vary, but common signs include slow system performance, unexpected pop-ups or advertisements, and unusual network activity. You may also notice that your browser homepage or search engine has been changed without your consent. In some cases, you may not notice any symptoms at all, which is why regular malware scans are essential for detecting and removing threats like Trojan.Agent.KB.

How to Remove Trojan.Agent.KB

1. Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow you to download and install removal tools.
2. Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove Trojan.Agent.KB and any related malware.
3. Uninstall any suspicious programs or applications that you don't recognize or that were installed without your consent.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
5. Reboot your computer and perform another full scan with your anti-malware tool to ensure that the threat has been completely removed.

Conclusion

Removing Trojan.Agent.KB from your system requires careful attention to detail and a thorough approach. By following the steps outlined above, you can help ensure that your computer is free from this malware and any related threats. It's also essential to take steps to prevent future infections, such as keeping your operating system and applications up to date, using strong antivirus software, and being cautious when downloading files or clicking on links from unknown sources. Remember that malware threats are constantly evolving, so it's crucial to stay informed and take proactive measures to protect your digital security.

SpyHunter Detects & Remove Trojan.Agent.KB

Analysis Report

General information

Family Name:	Trojan.Agent.RB
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 2d7c799d376ff326555484da7bc07aa8 SHA1: 7c8affb130ace89e56d8a1000f047633575d6188 SHA256: B5BEBA4C6CFB5CA870964F55EE4B35272AFF5776CD2ACC7C851D252B95461468 File Size: 349.44 KB, 349440 bytes

MD5: e61fd7c6a4a36b371dd9422674df377e SHA1: a72bae0bb61922312d6b8eb330779f122e57b32a SHA256: D61F8ADA3213D64A170FAC1C9BE34BA79104B89E267BCBA5CFC4652B63784B73 File Size: 739.77 KB, 739768 bytes

MD5: 1de967f52520fbe1fc675bee28a9071f SHA1: 7dd00107adc250b2b1e023e48708a2d3b4070a8d SHA256: 1D4A9308764109F2F96D1F7FB21A40783930EDECC10D481A7D4D2F545C752721 File Size: 2.03 MB, 2027008 bytes

MD5: cc5776cda9e04105ead8a9e5a8cf2896 SHA1: 628713c5db227a655879746d72493de70e44bbbf SHA256: 02390D41570C776B40FA42F1EB00D91F6260E4A0227500C9A688A3183211AF6B File Size: 1.11 MB, 1111040 bytes

MD5: 079a97434efb2a68d14c5d64607ed564 SHA1: 8802b28846754daee988f24880ec41e39e43c84c SHA256: C8D7E566592E5AEA50C4B746844B47055027F7B7F31597324E7081D982DB3C0B File Size: 470.02 KB, 470016 bytes

Show More

MD5: e1ec3026335b87529b722a51402a87f6 SHA1: c5684f3bf59a9753ee18ab870973bc01ae42578f SHA256: 9EE1D8D78FD36FD0C4075FC577476FA501A905A18CEEED900728DB129AEC892B File Size: 487.94 KB, 487936 bytes

MD5: 31ae21dc4f0defadf3cfbd6e973fe3f0 SHA1: 494c9cf90b35b4fa5cf282c4c6ba33ee4c2b45f9 SHA256: 276BF098BF7226CD4E70B5623179502412245D7E46CED74277BAA907C7A49449 File Size: 396.29 KB, 396288 bytes

MD5: 1e566419cd8ea405af60134246607958 SHA1: 180a10ba5310e4693110c7b0ded9c811d0a5bd75 SHA256: 1F9136437C408020F1D8E1E5A7D8B582B798A144C88503FB473FFA7C75505251 File Size: 360.96 KB, 360960 bytes

MD5: b4520b6b573e3e4d9b99df7c2fef7388 SHA1: 0b0873ad3ea9368f3acbe5a164663d585faf44e4 SHA256: FD3712A3544B405D13423C583FE7E3515CE4A6EAFE4BF3E9103BD693E4A65134 File Size: 2.01 MB, 2014720 bytes

MD5: 5bf136329e944406a03ac4d7b79f25b1 SHA1: 4add428d2751ed34d8caf74130ed0d2ac66e774a SHA256: EF849D9F342308501A7EF01C61DBB5930103E7411397216C94F5CC928881EB8E File Size: 335.87 KB, 335872 bytes

MD5: b3d8b6f4a5866eaf5d5502905af6c111 SHA1: e7a0b655d4f60d8e6d96738a380d6bae6ab23ba9 SHA256: A54F0A80E08C958C916C3A26BBA32D1AAD8F665053A2AC941E6CDF0B5DDCFC36 File Size: 585.22 KB, 585216 bytes

MD5: a681dc72d6fec1986191f96cbc4f8eb5 SHA1: dcf550ca418fb5867a06c1e912fab2d99c4ab0f3 SHA256: 37E8372F5759262D1F5395AB2D4E7001E8EBEFECCC9EDAE48F116867EE574431 File Size: 1.66 MB, 1659904 bytes

MD5: b01dbeebad332ced48e04790211b1298 SHA1: dc5819ba0ef2c554580c15b37fcfc9a6ff149a02 SHA256: DAADD0347C68DCB557F2FA32CA7B791A5E81D2F271E2A6408ABB723C9875A9C3 File Size: 1.27 MB, 1269760 bytes

MD5: b7f1bd636537484e35f4c771c0326f00 SHA1: 8a86d12706ef6df419061f664c4d8ec93e1c5315 SHA256: 50544D7497CAA47FC67F134D547959844A7C2739785CC92B6B5933D700CE5488 File Size: 347.14 KB, 347136 bytes

MD5: 86dcc2b0cf483b26930788f38f2d6ecb SHA1: 5ca700a34df6e7c927476efb0d6a5c0f39536cca SHA256: 321AF0A8ED2E7D8E97AEA90ABBF9212B5772232AB4098B99D13D39586AE507D6 File Size: 571.90 KB, 571904 bytes

MD5: 03edf0459c24609f8b4290fea1b47324 SHA1: f8671d0dde27fd313e135ea9789ade3f6fc52e89 SHA256: 269B3702F792D35146535BCA268800132813C72176D50A6F7E44766C046547FE File Size: 727.82 KB, 727816 bytes

MD5: 975b8aea12b6b347a530882bed4d0e65 SHA1: 5abf9470928f6dd775362ad8a00a3be521b57424 SHA256: 1588C1F5F61CE10CDF5F21AF938A8A694AC1ACB285BA6480CC28C9D33F56E0EE File Size: 364.03 KB, 364032 bytes

MD5: 4fab59ef87538aa49cf870da88b2004e SHA1: ecb4eef63dd788c880eba6146d3f94c1976a7d78 SHA256: 01E951AAA62380FF7E3B3C35C8F5C45AA27793701392F10696CF37E661B63669 File Size: 1.70 MB, 1701847 bytes

MD5: a05ca6bd2101aba9f2e3b057122dc53e SHA1: a13615563c3a6765811ecd3edd23bf59fd05f3ed SHA256: AD245818DCD31C4648CD9954F4D95CEB49FDD1A726794A99D4D0C742A2059870 File Size: 1.31 MB, 1309184 bytes

MD5: 69274f88894ad486e270646e490c3d95 SHA1: 7912334f79e3c6ea2652cfdeeba314e51bd1d694 SHA256: 8FB8337AA24C2A1BAD43D147268B29A4F820E8F46DF4A00809799467B9EECAF3 File Size: 3.99 MB, 3987042 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
• File is either console or GUI application

Show More

• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Assembly Version	10.50.0.125 10.0.26100.1150 2.0.0.0 1.2.0.0 1.1.1.0 1.0.0.0
Comments	iBorneoPRO A5 MADARA Setup.exe this app update L2Warland Launcher on last Version This installation was built with Inno Setup.
Company Name	@Pkkf5673 Cracking the code 4 fun! Dylog Italia S.p.A. Microsoft Microsoft Corporation SWComm Warland GameGuard
File Description	ActualizacionRemota AhmedXSensi COM Surrogate Download_SplitPath ECUTools Setup Game Launcher Updater iBorneoPRO A5 Project X Roblox Lag Switch v5.5.2 Setup.exe Show More svchost WindowsFormsApplication1 人人股神
File Version	10.50.0.125 10.0.26100.1150 2.0.0.0 1.1.1 1.0.0.0
Internal Name	ActualizacionRemota.exe AhmedXSensi.exe Antimalware Service Scanner Application.exe dllhost.exe Download_SplitPath.exe Dylog.Adelmo.exe iBorneoPRO A5.exe MADARA.exe Roblox Lag Switch v5.5.2.exe StartZeus.exe Show More svchost.exe test.exe WindowsFormsApplication1.exe 超短得力助手.exe
Legal Copyright	Copyright (C) 2004 Macrivision Co... Copyright 2022 Copyright © 2013 Copyright © 2015 Copyright © 2018 Copyright © 2021 Copyright © 2025 Copyright © 2026 Dylog Italia S.p.A. © Microsoft Corporation. All rights reserved. Show More 方小侠 Q: 3358387
Legal Trademarks	Dylog is a registered trademark iBorneoPRO A5 Warland GameGuard
Original Filename	ActualizacionRemota.exe AhmedXSensi.exe Antimalware Service Scanner Application.exe dllhost.exe Download_SplitPath.exe Dylog.Adelmo.exe iBorneoPRO A5.exe MADARA.exe Roblox Lag Switch v5.5.2.exe StartZeus.exe Show More svchost.exe test.exe WindowsFormsApplication1.exe 超短得力助手.exe
Packager	Spoon Virtual Application Studio 2012
Packager Version	10.4.2380
Product Name	ActualizacionRemota AhmedXSensi Download_SplitPath Dylog .NET ECUTools Game Launcher Updater iBorneoPRO A5 InstallShield (R) Microsoft® Windows® Operating System Project X Show More svchost WindowsFormsApplication1 Roblox Lag Switch v5.5.2 人人股神
Product Version	10.50.0.125 10.0.26100.1150 2.0.0.0 1.1.1 1.0.0.0

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Dylog Italia SpA	DigiCert Trusted Root G4	Root Not Trusted
MADARA	MADARA	Self Signed
blogmania	thawte Primary Root CA	Hash Mismatch

File Traits

• HighEntropy
• Installer Version
• No Version Info
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Babylon.D
• Darkkomet.A
• Kryptik.XXF

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe	Generic Read,Write Attributes
\device\namedpipe	Generic Write,Read Attributes
\device\namedpipe\pshost.134137549411048593.6924.defaultappdomain.powershell	Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288
c:\allcry.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\qbridge.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\__psscriptpolicytest_xtcoshtg.ktr.ps1	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\__psscriptpolicytest_zp5dmlhr.tsx.psm1	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\is-sb9ll.tmp\7912334f79e3c6ea2652cfdeeba314e51bd1d694_0003987042.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-ue8g7.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\winlogon.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\roaming\winlogon.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\roaming\winlogon.exe	Synchronize,Write Attributes
c:\users\user\desktop\readme.txt	Generic Write,Read Attributes
c:\windows\assembly	Synchronize,Write Attributes
c:\windows\syswow64\winsrv.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�g E +� �� �� ۀ ������Bx�< ��#@�$¨%f�)E *9 *�" 0P% 1HO9�@V�@��B��N$ U_* \te c�wg��n�A o�� v�! y�y�^|ۘ~D �P��� ��� ��7 ��a��3 ������������O��Θ���48 �8��`�����[�m�Ù���p�'��IV�V�$	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	샒赣ǜ	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enablefiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableautofiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::filetracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::consoletracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::maxfilesize		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::filedirectory	%windir%\tracing	RegNtPreCreateKey

Show More

HKLM\software\wow6432node\microsoft\tracing\rasmancs::enablefiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableautofiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::filetracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::consoletracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::maxfilesize		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::filedirectory	%windir%\tracing	RegNtPreCreateKey
HKCU\local settings\muicache\1b\52c64b7e::@c:\windows\system32\input.dll,-5000	US	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	㛝쩯Ḿǝ	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	fn h�" a �� �v ��T��������5��Bx"Wc#�&� (�(X�)�`*9 *�" +�[/��1`1�1HO1�D9ߔ@V�A��D� H[uN$ N�R20U_* _�z`�2b"hc�we�vg�j�bk`k�ql(�lR o�o�wp* tǤw�mw�ny�9{b�{�=~D �Jq�P��jI	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	gn i�" a �� �v ��T��������5��Bx"Wc#�&� (�(X�)�`*9 *�" +�[/��1`1�1HO1�D9ߔ@V�A��D� H[uN$ N�R20U_* _�z`�2b"hc�we�vg�j�bk`k�ql(�lR o�o�wp* tǤw�mw�ny�9{b�{�=~D �Jq�P��jI	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	鴰 ȁ ਪˣ 鈯ˣ 遙̃ 豤̃ অˣ 炑̃ 濖̃ 賬̃ 獖} ਷ˣ 邯̃ 뫯ʃ fꙥž iNꙥž s ꙥž } ꙥž  ꙥž	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	hn i�" a �� �v ��T��������5��Bx"Wc#�&� (�(X�)�`*9 *�" +�[/��1`1�1HO1�D9ߔ@V�A��D� H[uN$ N�R20U_* _�z`�2b"hc�we�vg�j�bk`k�ql(�lR o�o�wp* tǤw�mw�ny�9{b�{�=~D �Jq�P��jI	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	in l�" a �� �v ��T��������5��Bx"Wc#�&� (�(X�)�`*9 *�" +�[/��1`1�1HO1�D9ߔ@V�A��D� H[uN$ N�R20U_* _�z`�2b"hc�we�vg�j�bk`k�ql(�lR o�o�wp* tǤw�mw�ny�9{b�{�=~D �Jq�P��jI	RegNtPreCreateKey
HKLM\software\classes\.allcry::	Allcry Software	RegNtPreCreateKey
HKLM\software\classes\allcry software\shell\open\command::	C:\allcry.exe "%1"	RegNtPreCreateKey
HKLM\system\controlset001::allcryid	DCH9T-HLS2C-4806C-L2BI2-BAAGV-BXBFL	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
User Data Access	GetComputerName GetComputerNameEx GetUserDefaultLocaleName GetUserName GetUserNameEx GetUserObjectInformation
Anti Debug	IsDebuggerPresent NtQuerySystemInformation OutputDebugString
Encryption Used	BCryptOpenAlgorithmProvider CryptAcquireContext
Other Suspicious	AdjustTokenPrivileges SetWindowsHookEx
Process Manipulation Evasion	NtUnmapViewOfSection ReadProcessMemory
Process Shell Execute	CreateProcess ShellExecuteEx WriteConsole
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant Show More ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Network Winsock2	WSAConnect WSASocket WSAStartup WSAttemptAutodialName
Network Winsock	closesocket freeaddrinfo getaddrinfo recv send setsockopt
Network Winhttp	WinHttpOpen
Network Info Queried	GetAdaptersAddresses GetNetworkParams
Keyboard Access	GetKeyState
Process Terminate	TerminateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"powershell.exe" -c "if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { Get-MpPreference | Select-Object ExclusionPath } else { Write-Host 'DefenderNotInstalled' }"

Open C:\QBridge.exe

Open C:\windows\system32\winsrv.exe

(NULL) cmd.exe /C ping 127.0.0.1 -n 3> Nul &copy C:\QBridge.exe c:\users\user\downloads\f8671d0dde27fd313e135ea9789ade3f6fc52e89_0000727816

WriteConsole: 'ping' is not re

Show More

WriteConsole: C:\QBridge.exe

WriteConsole:

WriteConsole: The system canno

WriteConsole: 0 file(s

"C:\Users\Rcpijllt\AppData\Local\Temp\is-SB9LL.tmp\7912334f79e3c6ea2652cfdeeba314e51bd1d694_0003987042.tmp" /SL5="$130270,3291303,721408,c:\users\user\downloads\7912334f79e3c6ea2652cfdeeba314e51bd1d694_0003987042"