Trojan.Agent.KFZ
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 11,787 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 161 |
| First Seen: | October 24, 2025 |
| Last Seen: | June 16, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Agent.KFZ on your system indicates a potential security threat that requires immediate attention. This report provides an overview of the threat, its operating mechanisms, symptoms of infection, and a step-by-step guide on how to remove it from your computer.
Table of Contents
What Is Trojan.Agent.KFZ?
Trojan.Agent.KFZ is a type of malware that falls under the category of Trojans. Trojans are malicious programs that disguise themselves as legitimate software, allowing them to bypass security measures and gain unauthorized access to a computer system. The name "Trojan.Agent.KFZ" suggests that it is a variant of Trojan malware, but without specific details, it's crucial to understand the general behavior of such threats to effectively combat them.
How Trojan.Agent.KFZ Operates
Trojan malware, including Trojan.Agent.KFZ, typically operates by deceiving users into installing them on their systems. Once installed, they can perform a variety of malicious actions, such as stealing sensitive information, downloading additional malware, or providing unauthorized access to the infected computer. These actions can lead to serious consequences, including identity theft, financial loss, and compromised system security.
The exact mechanisms of Trojan.Agent.KFZ might not be fully understood without detailed analysis, but it's known that Trojans often exploit vulnerabilities in software or manipulate users through social engineering tactics to achieve their goals. Understanding these tactics is key to preventing future infections.
Symptoms of Infection
Identifying a Trojan infection can be challenging due to their stealthy nature. However, there are several symptoms that might indicate the presence of Trojan.Agent.KFZ or similar malware on your system. These include, but are not limited to, unexpected changes in system performance, such as slower operation, unusual network activity, pop-ups or unwanted software installations, and changes in browser settings or homepage redirects. If you've noticed any of these symptoms, it's essential to take immediate action to secure your system.
How to Remove Trojan.Agent.KFZ
- Boot your computer in Safe Mode with Networking. This will limit the malware's ability to interfere with the removal process.
- Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system. This tool can help identify and remove Trojan.Agent.KFZ and other potential threats.
- Uninstall any suspicious programs that you do not recognize or that were installed around the time you noticed symptoms of infection. Be cautious and only remove programs you are certain are not necessary for your system's operation.
- Reset your web browsers (Chrome, Firefox, Edge) to their default settings. This can help remove any malicious extensions or settings changes made by the Trojan.
- Reboot your computer and perform another full scan with your anti-malware tool to ensure that all traces of the malware have been removed.
Conclusion
Removing Trojan.Agent.KFZ from your system requires careful steps to ensure that all components of the malware are eliminated. By following the guidance provided and maintaining vigilance against future threats, you can help protect your computer and sensitive information from harm. Regularly updating your operating system, browsers, and security software, along with practicing safe computing habits, such as avoiding suspicious downloads and links, are crucial in preventing malware infections. Stay informed and proactive in your computer's security to minimize the risk of falling victim to malware threats like Trojan.Agent.KFZ.
Analysis Report
General information
| Family Name: | Trojan.Agent.KFZ |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
1ee1cd00607f102beefab19dc7c1048c
SHA1:
5a6b44ebfb98c96775e2381802ef9b28a8de280c
SHA256:
F79D394557A95979C60C5BC626D42606C422A2FC8960C85F79B5911969EE4CC5
File Size:
1.35 MB, 1346048 bytes
|
|
MD5:
ae371018618c09a57ce3d5501c4c7b28
SHA1:
f77006a6638cd05b6b87370290d2d0435d810914
SHA256:
7E57EB8D03967A9CBE42E24A621F4855ED57A6F9701C6FFA13806DFBA46B52A8
File Size:
2.31 MB, 2306048 bytes
|
|
MD5:
2235751315890946c5b0d2e11e0716ae
SHA1:
a01ede11db5322a1c546d214c9d4908dc82bd7c1
SHA256:
8D3B6BD4C65BB372A9B06F702388AA2461FE42DF99949973B620DE32E3FA4013
File Size:
2.23 MB, 2233344 bytes
|
|
MD5:
6c07a6a45cdee678764d5488b8b58c4c
SHA1:
9945015ce526d91ebbcdaa988dec5a81484b0a1e
SHA256:
28DC5A59B7E54C66DC05328439CD3F89C40924B709B17CE2D7F057F9D7954FA6
File Size:
2.28 MB, 2282496 bytes
|
|
MD5:
535e848f0b461c3823aebae3412c2146
SHA1:
a5bfc0f383f501110e993fa5b4488b9070f8a58f
SHA256:
535F43B724D1A3FF721ECCFF61CB0F8EA79F5B4EED93A8B94B70F1E7FEF60FB4
File Size:
2.27 MB, 2273792 bytes
|
Show More
|
MD5:
0c7a101135aaccbfc0e635ea28990f23
SHA1:
9bfca0c502f1f5e98cf9ea9a7a8ff68f8cf5484b
SHA256:
7C3A00327259ADEFC681C7512B20991695FEA02CF2D9137276FFB44F28FC5227
File Size:
2.28 MB, 2277888 bytes
|
|
MD5:
283e7e13a4db69b16b899a4d78f33b41
SHA1:
db4c5d70764c8907474fdfaec02badbaf72f1093
SHA256:
FC9F0AF763E3E718B0DB2E78FF3D79F71D8EA76F60040B974416B42376F7888B
File Size:
2.26 MB, 2264576 bytes
|
|
MD5:
2c839820f874ef6fc4a61110bb00471f
SHA1:
74b221d9286776b535d37ab4a9beca68ca1dad6f
SHA256:
7639032B6D5B7868F5A94EE3B23C185EAE7433075B2FCCEC3147D9925D1E06D5
File Size:
2.35 MB, 2347520 bytes
|
|
MD5:
cac4919467b816b38dd50b79acea0484
SHA1:
0a2a6983fc4fc04414019e640c43a34802e27ed1
SHA256:
670F6232A6AB2BBDA061D4FCAC3C3D68904A01ABC677B08189FAFADB1EEC5E75
File Size:
1.44 MB, 1440768 bytes
|
|
MD5:
3020899ae39aa4c4b2cc0ae3abd03ee8
SHA1:
c43a9aedc34c6921b98f5e620c811bb07077922d
SHA256:
3FE06341F9A23A4EC75716215D5A5B9F50DB33BAF5A83E2DF85C870D9EB92814
File Size:
1.42 MB, 1415680 bytes
|
|
MD5:
263964d6694c6e98529c702aab050302
SHA1:
f64f32dea3c6fdae689f2ed10908cdf0d8f2286f
SHA256:
C20C23DB13730AB55B22366B5222DBE416042E4E40DA5F40DBA0D2EAFEDD46F7
File Size:
2.28 MB, 2281984 bytes
|
|
MD5:
d9220bf75c937246f8046931bbd96ce6
SHA1:
d12cc3a14bcf653a5f37c9b511be298fbe367ad1
SHA256:
C85093DA0FB29C66B16FF120990B08C06EDB865CEA673AB66975816383E1D71D
File Size:
2.30 MB, 2298880 bytes
|
|
MD5:
bbea1f0794a28fc5f57c4c3bbc562d0d
SHA1:
9ec31b89ac7442f5724939bd6c1b68927317c1b3
SHA256:
E466C12F6D18DFEE0AFA22898C98753353436FDF1EB2FD3041FB41360A8805D7
File Size:
2.50 MB, 2496000 bytes
|
|
MD5:
14bbe12cbd19c4c5850887b1c55b0c06
SHA1:
e33537553f052d8a797b7a98664f907ad69b0c07
SHA256:
504CBFBD9A0E7BF140E4F5C5514BB59D8F51BB23F60AC77D453DDA8B1735725D
File Size:
1.40 MB, 1403904 bytes
|
|
MD5:
0248caa81b09d33575da57364db3ee61
SHA1:
5241b0b21676bc653c2019dfc35860e800f8b4cc
SHA256:
A1F81665BBC205C32D05A8EFD0E0EF60D581C343B39CBE51361A89003AD9ACEB
File Size:
1.43 MB, 1434112 bytes
|
|
MD5:
9b3464b1e3497d15829f079e081a7214
SHA1:
25bc1a2ddd65eba32969b1869da9f5b9b8051f50
SHA256:
D3E05EDB8F547E1FC5311AFC5D0ED0156878EF3BD5D99ACDA2F94C3B19A69F97
File Size:
1.47 MB, 1466880 bytes
|
|
MD5:
00ec737506bc0ea0771682a3cda63b06
SHA1:
73527dea13e590c280c6e44114c08443713145ff
SHA256:
1813AF2FD3682AD7D8C4130D5876242AAA9F9A05E64A93D7CC11CC5B4D46922C
File Size:
1.76 MB, 1761280 bytes
|
|
MD5:
16ab1ceefd327e72a54955809f394e0f
SHA1:
274f638a4fbac4719afa53c74edcc79265c13b46
SHA256:
091F259F2DCE4815D30B04B79323CB1A6C0967B4F06CA4955E770CAD434E4300
File Size:
1.83 MB, 1829888 bytes
|
|
MD5:
e68e37cc106e8cc0a472c2e47e947461
SHA1:
9a8669e44c5fc10c8a734d11ba232b8a30fd1513
SHA256:
F325987A5D08C5A4A612281EAD9239A25D34D212431BE428B2BF02328A30E4AF
File Size:
1.47 MB, 1474048 bytes
|
|
MD5:
b02cc0942a003da21976673f820bec71
SHA1:
d95ae0b4ebbff400b30c7a04853fa0dfddbe9e76
SHA256:
8BEC061EEACC2CD230DE686C3D0D12F283539E53880DE077ACBC5DA3442E3C83
File Size:
3.34 MB, 3337263 bytes
|
|
MD5:
59c22d305c21f06059d219911d07e2cd
SHA1:
f6d2f40d0386132d9a5015ed1b24fc049988c539
SHA256:
56F53B20E6E3091B1E347F1E7EB1E9DCC46D2978DB49F40F863CA987BBB62D5A
File Size:
1.81 MB, 1807360 bytes
|
|
MD5:
e72922050e5e26e22c082109e3b4d2d4
SHA1:
fe84ece663c475564e87773e20de2911430b2674
SHA256:
35DB86D2BE4EBB9EB0FC53C01028860CAA7AA9BB8D75CE99234503E68037C445
File Size:
2.62 MB, 2621440 bytes
|
|
MD5:
f7c698f39c224a8e4d308746a50f90f6
SHA1:
5f27bce9779cfef5267d76475420c20dd182d08e
SHA256:
12BBDA547A2D4BC91F20BE43A83B4567648895EF7FCEDA1DD920AD1CAA30B745
File Size:
2.25 MB, 2245632 bytes
|
|
MD5:
1fb561f37a2bdcfc1d135db57c23dc60
SHA1:
e8ddc3285041992ee85dad9cfceb11db094009c1
SHA256:
D2A5208B737DFDFB8C3B97E52F424643F0703863A964CD6017E502FF5261D10F
File Size:
3.67 MB, 3667561 bytes
|
|
MD5:
323cec58091e140023b0f247a3c1175b
SHA1:
69b4a4779feade3c5ec9e076c27d83904ef5d7cf
SHA256:
867A74DE43DC66133C0D56298375900ED909B7D9339D61AE3096805A1D49FB5E
File Size:
2.09 MB, 2088960 bytes
|
|
MD5:
dd25205a1239c3175e33626594a7866a
SHA1:
bcd5fa26e92c8d8f13c1ad0256987d0b06c52dfb
SHA256:
19164BC09DF67586018A638A2C929C19C642863B3FF463E7E85FD8141918C52E
File Size:
2.05 MB, 2052096 bytes
|
|
MD5:
33a063a3b421c0841a0126d2c6549e2e
SHA1:
609761a2ceddd2dc172ca2dc5c3ec70f34a7d2dd
SHA256:
D69DD2CA4D6051C6B08169441D62163CEE528F521555DC86A2300304D0A5C53D
File Size:
1.75 MB, 1747968 bytes
|
|
MD5:
cc814b211204d4e95e8424407f1ad652
SHA1:
4bc58788ee3077cb0c2ae78295c643e557f28210
SHA256:
BC12D60FA3D07E4084EC4D781C95C76AB7A029BAE6FA3F0ADF3821924F87CC8F
File Size:
2.06 MB, 2058752 bytes
|
|
MD5:
a5a323bb7b5fe87ff1fe9aa5c455e6c5
SHA1:
079d9fdc6f9e9ff262eef6ed11bab92c86b268b1
SHA256:
A2D6C7EBD7870C1117A75BF4BE667E3C0A5737E639DAFBA1639FAA4ABD245134
File Size:
44.03 KB, 44032 bytes
|
|
MD5:
f246cc3e94253e1e9fa776fced26b64f
SHA1:
5f925addf2ebe59d8bc10f3358098b91d17b40fd
SHA256:
549748B1F1AD5105633DFE137DA163066E204230883E1B99F21EB7A4C0A27E49
File Size:
2.04 MB, 2042880 bytes
|
|
MD5:
9ccc7ea4bdeeb15d5fc7cd1ca4676230
SHA1:
575c5be2c13fc478d7fbc148e172b5aa0e6f2a78
SHA256:
5750FD92C51530584887A07D89E6AC1DFA7E34E8DAEB92D8279B85AF3FC67D78
File Size:
2.05 MB, 2049536 bytes
|
|
MD5:
8883340fe0b545d17d882ebaf2cb1a86
SHA1:
7b32571a68e73ab51722e8f684a445a1c70dc62d
SHA256:
A5AAF432D614E8F6C43A4666AD667CDB2CB9F737E19AAE3D9A6BCB6691EB296A
File Size:
1.72 MB, 1716224 bytes
|
|
MD5:
fd36f5140397e9a5ba69a4c60c43341e
SHA1:
29fbe3e1872ed7ead0842ee5b7a5c3efcbcff3a1
SHA256:
745EC84BF8D6088BFBD5582DB99BEDAD0AFD73D2EADDAA4FAF3E0C86C676E87F
File Size:
2.14 MB, 2136064 bytes
|
|
MD5:
404131ee8f1dd1a4e1138f94e414f682
SHA1:
e54d59dd4f1753a4a43d12df8e3ae3ee7a5bbb4a
SHA256:
98FD552276FDDA3C9794B1B73D34BFADDE5E56954F983DBCCB0151360CC79679
File Size:
127.32 KB, 127320 bytes
|
|
MD5:
0d0dd42282d7707c575fc3737913e7c3
SHA1:
6883e8da71304d5233ba4699fd1c8907c787d0cd
SHA256:
F96D794F607C98B1985A453438BE41EEAC6EB23A78E3C677D5286275689D0DBA
File Size:
583.68 KB, 583680 bytes
|
|
MD5:
8d80939c3e9bfa602257e107ad58c073
SHA1:
591d1df7002f2a5670dcddadce8e75ca762e595c
SHA256:
E32EFBC77959CA2E443E6705E296AD218A3D07D271FEF7679615FA071B7BB6AE
File Size:
1.67 MB, 1665024 bytes
|
|
MD5:
4a47406011a523a67635a79c6cd660c2
SHA1:
ba1bdefdc2eaa781a16cbfb31004c444e28665fb
SHA256:
4A2C5D7423BDF8AE17F50E9A516EF5A327D11DBA3B00B94E25219E94C758FF94
File Size:
35.33 KB, 35328 bytes
|
|
MD5:
14377058681a3c40ba1ec220383253d5
SHA1:
c7483fe478975758be8c10c31ee70e3628f6baf5
SHA256:
DDBE85047CC23A0680F2D03B54DC0E9AA813FC46E4FD2E18CB04BFEED45BD6B9
File Size:
1.85 MB, 1849856 bytes
|
|
MD5:
1eea015cebb41edcfb276c2f5951ba91
SHA1:
88581e51c7328258b826b459eabb13c298178cb4
SHA256:
D3233EED1F104E9B63E2F049267FC0D15A8DF984D60B8C4D68CA7B14F016F617
File Size:
2.04 MB, 2041344 bytes
|
|
MD5:
010a18cf1d8ad688d13d29a2dc8bb098
SHA1:
e3f62f1bd8edaaba1a62ae735e5eccff2874ea03
SHA256:
88B87E7B4F4D2527D2C68318DDD45C8F2D6926EB2F24843EF7F04BA5896C10E7
File Size:
128.13 KB, 128130 bytes
|
|
MD5:
f806e0b0cff734b9beb20aec517ddc00
SHA1:
64349b5aa45e813d78e2a9b70e9fd7b8575c27d8
SHA256:
704CA67E0C1821B3BB3FD7FE9D94A8612D024938876202F608D38BD1BB8D5ADF
File Size:
127.69 KB, 127692 bytes
|
|
MD5:
b475e504382078ac5257ad29df490a6c
SHA1:
29168bb9c9f043e777521dfa6056d219b3adcd16
SHA256:
287CC896A61FE0F12B89DAA3FD5155882188BF56A63B9B556370C727B213CB88
File Size:
125.06 KB, 125063 bytes
|
|
MD5:
e469aeb219884de0c7f2aef32975e1f7
SHA1:
181ef3ffb922f8baa0dea08f8a2be499feb72f0e
SHA256:
C0768F338B29DBC95264D8EBB8882E8F0BDE268289E19E044613A4187CAB1CDF
File Size:
1.78 MB, 1777152 bytes
|
|
MD5:
679763ac37101db6c0db813b9ff006ae
SHA1:
d9353ba59e8de3f51729e044b3e15e1d3254f659
SHA256:
08A0490C960B7D4F61896A72633D2EECF9D50F4FCAC810A088B01F48217FE9A6
File Size:
723.97 KB, 723968 bytes
|
|
MD5:
30e116542beebea75c8be4001b95339f
SHA1:
1ad6be33e1d9e348aea13f6456491709d069d4fa
SHA256:
A33B2B37651C61B6F9ADC778AEEA28859FD60D46CFD3A883D2ACEBBD0E987C9F
File Size:
1.11 MB, 1108480 bytes
|
|
MD5:
43e66e8029c14a50071a6d1ab2a32a3d
SHA1:
89f8040fbb8f6ec2da739fbd82bed4b131b68455
SHA256:
679E54A02E0E54A25812BA94CC54352E4C3500D5AF0C20E577C89149E6B11624
File Size:
1.10 MB, 1104896 bytes
|
|
MD5:
364bc4d51e6c3bf1d3b6bb2d56c6f8fa
SHA1:
68ea32928acdd857e446947cda35c85114313f45
SHA256:
E3F2F508C2F7B94CAB63F08D59058D547D1FEEBE3F45AE00B12AB148ED125C4A
File Size:
1.11 MB, 1114112 bytes
|
|
MD5:
0165a0286f04aca10e9f8b2df26419cd
SHA1:
d2378e66b80b4841b41dfdffdff2b0bc7854b93f
SHA256:
607FE06168BDA3636726B8E173ADF006815BACEDBBEE2042097151EBF6DDE412
File Size:
1.30 MB, 1300480 bytes
|
|
MD5:
dc94157171d569dd1d708353b1b85ecb
SHA1:
c623952d0a578a2280d36458f0e8f2c0bf33f742
SHA256:
C396F060B0EF0B6C0DE35B024B1AE437EEAD023D68F26BBB06C653B4488687FD
File Size:
727.04 KB, 727040 bytes
|
|
MD5:
f88084b5bfbb82dbab1933e27214d965
SHA1:
0317a68b1d70d3639ca71917f57f4a961e3d321e
SHA256:
F545AE2AAA1F02CAFD3BD4C39633349990BFC4362978722E805D25280338BF63
File Size:
729.09 KB, 729088 bytes
|
|
MD5:
33ce242ea96c1e39e7698c820ad60407
SHA1:
55fa97530b215bf5946a715befa006370f11fbb6
SHA256:
9CCF1B2A5BE01916A4D9819FE5B1F8078482EEF2F04A144C6E2107EC7932EEE9
File Size:
127.73 KB, 127727 bytes
|
|
MD5:
5153e404cda5cdf9930012380530a2b5
SHA1:
a1684f995675b2d31814ed55057a3c9917fec759
SHA256:
A6A4DD17464445D4B9DF49A597D5E94778A2079C8C61B0218A13E27EBEE0F8B4
File Size:
1.36 MB, 1357824 bytes
|
|
MD5:
bdcb5798eaf6d5b30eec178e5c1b509e
SHA1:
037949ee2440d61c257a893d3191f47f06f4e305
SHA256:
77E3DCB09F593FDFAC516E1ED4AABDF864EF4DA11A10C0960292D3DF338DD1D2
File Size:
2.64 MB, 2638848 bytes
|
|
MD5:
fe5fef4f3214cdad3df921bcfb5bce1b
SHA1:
06ba562748b0b9cab697b3e1f7e89529fcf51f80
SHA256:
5CA6BC694E6117D4D76F9A59C88C5EE36D6FE6429BDBDC9151B3F92FF9943A8C
File Size:
1.11 MB, 1114624 bytes
|
|
MD5:
191b6f30398523596e76f6dad6e7ac44
SHA1:
c42dc3fd368e6001c784faff8e058e7fdd40de66
SHA256:
92037F9EE6002E985C231BBA8AFE794E6E8C8604CBCDF14286E2E33BB33FC6FD
File Size:
1.82 MB, 1818112 bytes
|
|
MD5:
fa27fbaaacc6e5ffbf17569097e27f9d
SHA1:
792a7df30a99abaf07f0dc84bd6865ba9ca3d288
SHA256:
DE2137284209DC56273C0B86D279AB409D40078542BC61380A7CE1B889B8EB6F
File Size:
1.10 MB, 1103872 bytes
|
|
MD5:
8529ee32cbf706773f30d62c53e96313
SHA1:
811e3f6ee4226029478ca9d7bae1e87e0f000e25
SHA256:
EA839C3706620DD30B49C8000EB993BD748EAFE6CC6F0BEB939A77039BAA033A
File Size:
1.71 MB, 1710080 bytes
|
|
MD5:
ce086ae3e943f73d5f7b1a3c4e4d96a3
SHA1:
d595fab17ef014ef52426fc283cd90f53478ae07
SHA256:
8BFA8A27A84BC1ED05293AB7A27750D24455182CA9F728A15EEF7F93C7CB0788
File Size:
1.12 MB, 1115136 bytes
|
|
MD5:
c4c4c7a0edd0ba6cf36f52c8796b3294
SHA1:
01c981d7db83dda9f3c9a77e03a00a0133dbb072
SHA256:
70E88CEBE45C190F97FFF57F0E98FFD3BB32C5082D7A0BF3F92EFE943FB514F9
File Size:
1.11 MB, 1111040 bytes
|
|
MD5:
bccee3fa4916d24b08fad3ba993f685e
SHA1:
2ef9c8e2a8684a51010b706cbe1779675652ca22
SHA256:
BE4685370E1EDEB246508B51C99F7E9B47DEE2612B5317C93F7DA13273C50F7C
File Size:
1.69 MB, 1694720 bytes
|
|
MD5:
37f93304d658edefc473c87f5c91abae
SHA1:
c36cd3f78bbfd6c731040bcb484a7935357d21ea
SHA256:
D518FD9D1294942E2C61FF3D02EEB09C17800B1F900F98148B5FC204A30818AD
File Size:
40.96 KB, 40960 bytes
|
|
MD5:
299b577ddab3a78058d525101938a6d9
SHA1:
81c1c120671edfe1c5007b56243fb1d857bebc0d
SHA256:
DD8011B2CF1DCE8B106570B8B5998CC7AF644CB22F08D11EB2412B475EF88448
File Size:
2.30 MB, 2297856 bytes
|
|
MD5:
2bb9e995172fe60ec01a320838ceade8
SHA1:
9760f0bbc28d1d90cca7d43a037eb384751deea9
SHA256:
253C5060560D4710FEC2A1CC6395D98F2E7C67DE2F5BF66D66744E9C57B94890
File Size:
127.03 KB, 127029 bytes
|
|
MD5:
af4660b68fe2b71b8064b62d3be9df18
SHA1:
4abd41f901dcca2c8f28b52c807bc535f695d688
SHA256:
D5EA87A0C598C24CA64B5D3E9884E6719BB305C7D8939F4CB7E5D6B2282D9AFE
File Size:
736.26 KB, 736256 bytes
|
|
MD5:
91be303afc9800d08226eec5f4fa511e
SHA1:
196802bfeda355102c9899091e1cfb8ad9c47719
SHA256:
CB38E27E2B0994115DA609919EAD694801345CD677A8781426017406B01F991E
File Size:
2.23 MB, 2229248 bytes
|
|
MD5:
78fcd1ff85114fbc6b71fb7ac8b66e2a
SHA1:
dfb1fcb053b41e05799e53735298d152c95d2d80
SHA256:
A9A1A371FC702EEBF2D7CBB291FE15E1CEE8416C53FC21B5D0F9980DEB4E2B5D
File Size:
2.59 MB, 2590208 bytes
|
|
MD5:
be37daf70ea5f8b95833ea9acd4371b4
SHA1:
1bd2e9adb276a9a6632d54f82371bb4c8fd8c33a
SHA256:
F636B5102B63289D58D718D7EBA1797CD8B2E7C0BF1022C828F01FF20D6E601E
File Size:
726.02 KB, 726016 bytes
|
|
MD5:
c670d9feed992330896fa3319a60b74e
SHA1:
f6e519307afc37651178d8191071ce003126140b
SHA256:
77758BE6B8DBAF548815A7691357D137B1F07456AE5C2DE6E0E0F8F87C78C1CE
File Size:
1.12 MB, 1117184 bytes
|
|
MD5:
017f95007fbd4fa645898f478306c684
SHA1:
a7db0c9db3e53ca8b0df5b1d2358017873bc0e06
SHA256:
B393D8F2E39E99D66B5AA3231BF7312B0AF7C14DBB21D99D28833571C4B9DAF3
File Size:
1.77 MB, 1765888 bytes
|
|
MD5:
17a14381de3bd895d42fdf9328353eab
SHA1:
eb73726ca8e019dd65183c383a0aa2ccc4f6f947
SHA256:
282B977B72139064250DBA19FA9DBDE03C6E3FA95709BF1D27DCFA09CC6466BC
File Size:
1.11 MB, 1107968 bytes
|
|
MD5:
91f2a87f21d23d71799a701c6f672e23
SHA1:
f57871b6fd22e8ced2d8fac0264cf50918e51cee
SHA256:
D8BB26B1837E80D641143E0144FC83AD9D026CC833D25D87DEF50AC3C6AB29B6
File Size:
729.60 KB, 729600 bytes
|
|
MD5:
506da0b964bb8e293f6c6715d4d5ffa0
SHA1:
a734edb3d197cf1c25551bf871b40d4699de01c3
SHA256:
9DF4B40891CF408A7508633C63E8CE068AE76DF26A799C594D8BC9623EF73213
File Size:
1.44 MB, 1438208 bytes
|
|
MD5:
c7da437e40c9c55e4c269feb404a430d
SHA1:
e39d0aeef72f19abd3eecfdfbb489655be941dbc
SHA256:
564CB9202BA0A312A6135204BD0E8AB2B6FEF3954DB3507DB31AAA2E6CD2B584
File Size:
2.71 MB, 2714112 bytes
|
|
MD5:
ecabe8f5098c9c59cae3c286f97e8ba1
SHA1:
c743cd022c47076173d65cf5263adc9b8b19eb41
SHA256:
DE3750E84E9366945474E7DFAC09C39E81C60B142EE12A1862B6E1D724C5F8E1
File Size:
629.76 KB, 629760 bytes
|
|
MD5:
8132a7f0d040a184ddd14c47219339f3
SHA1:
9bf2413a3fe1c55a73d9e6e11dcb9e538a2a7a5b
SHA256:
2775E4AA2563258140C6948D2A46C31E85D92A2D57B7B1C4D2B262276D721136
File Size:
630.27 KB, 630272 bytes
|
|
MD5:
97e200953c0fc9417538dfab5b96afee
SHA1:
1ed174d45f829d658b6c8c8695c4fb6a6bcceb73
SHA256:
A42A6C5E47C21D81B2D3C66D8A58282A3856051E75198F2AC9169B9513E25900
File Size:
906.24 KB, 906240 bytes
|
|
MD5:
9946d80b5f9f8fe7b6ba10a3bdace97a
SHA1:
1d9a37efc20c774a56544c2dbeb9cff438a74ab4
SHA256:
E82B1F269DFBA828AAB370AB6C9E4A72ED0DD139E5FB9E68D8295800D11E662E
File Size:
36.86 KB, 36864 bytes
|
|
MD5:
14d4ac6079e358dd9554cc18af578343
SHA1:
517ad30de61d1a34c18b61b0368b337bc3f47bc5
SHA256:
ECEAB32BCDFC818102060BB52E04FE191EE20227ECE28EA8E9F89F4ABC0644BB
File Size:
1.72 MB, 1717760 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
Show More
|
File Traits
- big overlay
- dll
- HighEntropy
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 6,185 |
|---|---|
| Potentially Malicious Blocks: | 1,682 |
| Whitelisted Blocks: | 4,403 |
| Unknown Blocks: | 100 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
?
?
?
x
?
0
0
x
x
0
x
0
x
x
0
x
0
x
x
x
x
x
0
0
0
x
x
x
0
0
0
x
x
0
0
x
x
0
0
0
x
?
x
0
0
x
x
0
x
x
x
?
?
x
?
?
x
?
?
x
x
?
x
x
0
0
0
0
0
x
0
0
0
0
x
0
0
x
0
x
x
0
0
0
0
0
0
0
x
x
0
0
0
0
x
x
0
0
0
x
0
x
x
0
0
x
0
0
0
0
0
0
0
0
0
x
x
0
0
x
0
0
x
x
0
0
x
0
x
x
0
0
0
0
0
0
x
0
0
x
x
0
0
x
0
x
0
0
x
0
0
0
0
0
x
0
0
0
x
0
0
x
0
0
x
0
0
0
0
x
0
x
0
x
0
0
0
x
0
x
x
x
x
0
0
0
0
x
x
0
x
0
0
0
0
0
x
0
0
x
x
0
0
0
0
x
x
0
0
0
0
x
0
0
x
x
x
0
x
0
0
0
0
0
0
x
0
0
x
x
0
0
x
x
x
x
0
0
0
0
0
x
0
0
0
x
0
0
0
x
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
x
0
0
x
x
0
0
0
x
x
x
0
0
0
x
0
0
x
x
0
x
x
0
0
x
x
0
0
x
0
0
0
0
0
x
0
0
0
0
x
0
0
0
x
0
x
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
x
0
0
x
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
x
0
0
0
x
x
0
0
0
0
0
0
x
0
0
x
x
0
0
x
0
0
x
0
x
x
x
0
0
0
0
0
0
0
0
x
0
x
0
x
0
0
0
0
0
0
x
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
x
x
0
0
0
x
x
x
x
x
x
x
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
x
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
x
0
x
x
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
x
0
0
x
0
0
0
0
x
0
0
0
0
0
x
?
0
0
x
0
0
0
x
x
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
x
0
0
x
0
0
x
0
0
0
0
0
x
0
x
x
x
x
0
x
0
0
0
x
0
x
x
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
0
0
0
0
x
x
0
0
0
x
0
0
x
x
x
0
x
0
0
x
0
x
0
0
x
0
x
0
0
x
0
0
x
0
0
0
0
x
0
0
x
x
x
0
0
0
x
0
0
0
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
?
0
x
0
0
x
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
x
x
0
0
x
0
0
0
0
0
0
0
0
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
x
0
0
0
x
0
0
0
0
0
x
x
x
x
x
x
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
x
0
0
0
0
0
x
0
0
0
0
x
0
x
0
0
0
x
0
x
0
0
x
0
x
x
0
x
0
0
0
0
0
x
x
0
x
0
0
x
0
0
0
0
x
x
x
x
0
0
x
0
0
0
x
0
0
0
0
x
0
0
0
x
x
x
0
0
0
0
0
0
x
0
0
x
0
0
0
0
x
0
0
0
0
x
x
x
0
0
0
x
0
x
0
0
x
0
0
0
x
x
0
x
0
x
0
x
0
0
0
x
0
0
x
0
x
0
0
0
0
x
0
x
0
0
0
x
0
x
0
x
0
0
x
0
0
0
0
0
0
0
x
0
0
0
x
x
0
0
x
0
0
0
0
0
x
x
0
0
0
0
x
x
0
0
0
x
x
0
0
0
x
0
0
0
0
0
x
x
0
0
0
x
0
0
x
0
?
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
x
x
0
0
x
0
0
x
0
0
x
x
0
0
0
0
x
x
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
x
x
0
0
0
x
0
x
x
0
x
x
0
0
0
0
0
0
x
x
x
x
x
0
0
x
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
x
0
x
0
x
x
x
0
x
0
x
0
x
0
x
0
0
x
0
x
0
x
0
0
0
x
0
x
0
0
0
x
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
x
x
x
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
x
x
0
x
0
0
0
x
0
x
0
0
0
0
x
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
x
0
0
0
0
x
0
0
x
x
0
x
0
0
0
0
0
x
0
x
x
0
x
0
x
0
0
x
x
0
0
0
0
x
0
x
x
x
x
x
0
x
0
x
0
x
x
0
0
0
x
0
x
0
0
0
0
0
0
0
x
0
x
x
0
0
x
0
0
x
x
x
0
0
0
x
0
0
0
x
0
x
0
0
0
0
0
0
0
0
x
x
0
0
x
0
x
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
x
0
x
0
0
0
0
x
x
0
0
x
0
0
0
x
0
0
0
0
0
x
0
x
0
0
0
x
0
0
x
0
x
0
x
0
x
x
0
0
0
x
0
x
x
0
x
0
x
0
0
0
0
0
x
0
0
0
0
x
0
x
0
x
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
x
0
0
0
x
x
0
0
x
0
0
x
x
0
x
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
x
x
0
0
x
0
x
0
x
0
0
0
0
x
0
0
0
x
x
0
x
0
0
x
0
x
0
x
0
x
0
0
x
0
x
0
0
0
x
0
0
0
0
0
x
0
0
0
x
0
x
0
0
x
x
x
0
0
0
x
x
x
0
0
x
0
0
x
0
0
x
x
0
0
0
x
0
0
x
0
0
0
0
0
0
0
x
x
0
0
x
0
0
0
0
x
0
x
0
0
x
x
x
x
0
0
0
0
0
x
0
0
x
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
x
0
0
x
0
0
x
0
x
0
0
0
x
0
x
x
0
0
0
0
x
x
x
0
0
0
0
x
0
0
x
x
0
0
0
0
0
x
x
x
0
0
0
0
x
x
0
0
0
x
0
x
0
x
0
0
x
x
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
x
0
0
0
0
x
0
0
x
0
x
0
0
0
0
0
x
0
0
x
x
0
x
0
0
0
0
0
x
x
0
0
x
x
x
0
0
0
x
0
0
0
x
0
0
0
0
x
x
x
0
0
0
0
0
0
0
0
x
0
x
x
x
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
x
0
x
x
x
x
0
x
x
x
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
x
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
x
x
x
x
x
0
0
0
0
x
0
0
0
0
0
0
x
x
x
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
x
0
0
0
0
0
0
0
x
0
x
x
0
0
0
0
x
0
0
x
x
0
x
0
x
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
x
0
0
0
x
0
0
0
x
0
0
x
0
0
x
x
0
0
0
x
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
x
0
0
x
x
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
x
0
0
x
x
x
0
0
0
0
0
x
x
0
x
0
0
0
0
x
x
0
x
x
0
0
0
0
x
x
x
0
0
x
0
0
x
x
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
x
x
0
x
0
0
0
0
0
x
0
x
x
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
?
0
0
x
x
x
0
0
x
0
0
0
x
0
x
0
0
0
x
0
x
0
0
x
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.KFZ
- Kryptik.OPD
- Trojan.Kryptik.Gen.CMD
- Trojan.ShellcodeRunner.Gen.DO
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �l + \x +� xy �� Bx �R #@�%f�1HO 9�>3� @V� d��n�ArnJ u�~ y�y�^�� �P� �ރ �����|� � �b:��� �������� �6� �a �� ����m� Ù� ��p�'��t� �� �$�` ��o �!U � �M � 6T�= � \�} `�V�P� ��� �zH�Q] �� @ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | Hk tX �v����(�*J1�1HO @V� G�IH[u_�zk�qq�Xw�n{b��P� �jI������ ������ ���*�m� Ù� ����$�8წ���&M �=�S/� .SLB1_ T�Vw�`�V��%������ �AE�Q] ��D��&��$���L�� @ K� | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
