Trojan.Agent.KYE
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| Infected Computers: | 0 |
| First Seen: | September 12, 2026 |
| OS(es) Affected: | Windows |
Trojan.Agent.KYE is a Windows-based Trojan horse classified as a high-risk threat, with a danger level that places it among the more serious infections a computer user can encounter. Like most threats in the Trojan category, it is designed to disguise itself as legitimate software while secretly carrying out malicious operations in the background, often without any visible warning signs to the user.
Table of Contents
What Trojan.Agent.KYE Does
Once active on a system, Trojan.Agent.KYE runs silently in the background, avoiding detection while it carries out harmful tasks. It is built to give attackers remote access to the infected machine, potentially allowing them to gain complete control over the system. This level of access can let cybercriminals covertly delete files, install additional malware, and carry out other damaging actions without the victim's knowledge or consent. Because it operates as a native 64-bit application without typical packing, it can blend in with legitimate processes and evade casual inspection.
How It Usually Gets Onto Computers
Trojan.Agent.KYE typically infiltrates computers by exploiting system vulnerabilities and security flaws. It is also commonly spread through software downloads from malicious or compromised websites, as well as through email attachments sent from untrusted or unknown sources. These attachments may be disguised using various file extensions, including executable files, media files, or even image files, tricking users into opening them. As with most Trojans, the infection process relies heavily on deception — the malicious file is often presented as something harmless or desirable to encourage the user to run it.
Risks for the User
The risks associated with Trojan.Agent.KYE are significant. Because it can grant attackers full control over an infected system, victims may face a wide range of consequences, including data theft, further malware infections, system instability, and loss of privacy. Trojans of this type are frequently used as a gateway for deploying additional malicious payloads, meaning a single infection can quickly escalate into a much larger security problem. Sensitive information stored on the device could be exposed, and the compromised system could even be used as a launching point for attacks on other machines or networks.
Signs of Infection
Trojans are notorious for operating stealthily, so visible symptoms are not always obvious. However, users may notice unusual system behavior, such as unexpected slowdowns, unfamiliar processes running in the background, programs launching or closing without user action, increased network activity, or new files and programs appearing that were not intentionally installed. Security software flagging unknown or suspicious files is often the clearest indication that a system has been compromised.
How to Stay Protected
To reduce the risk of infection, users should avoid downloading software from untrusted or unofficial websites and refrain from opening email attachments from unknown or unexpected senders. Keeping the Windows operating system and all installed software fully updated is essential, as this closes off the security vulnerabilities that threats like Trojan.Agent.KYE often exploit. Regular system backups, cautious browsing habits, and maintaining up-to-date security tools can further help detect and block such threats before they cause damage. If infection is suspected, the affected system should be scanned and cleaned promptly to prevent further harm.
Analysis Report
General information
| Family Name: | Trojan.Agent.KYE |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
dd77ae302b5fc93b77f705020c89c9d2
SHA1:
e15c44ac87eecd0815ced14d89d5746a9a0023b5
SHA256:
87667D804B415E8F6CF156ED71D78ADC6871DBC9B1708BA66AC7029FC981B546
File Size:
2.45 MB, 2445312 bytes
|
|
MD5:
36002c80dd46ab52f181be2a1faa6f7f
SHA1:
c4ecef10cb0a4b9bf70f65bb5651a4ba20bfa24c
SHA256:
E002F043B38AA79E74A4D9A5E6F8CB85E0646067D37E93920F9AD23EF94F1EBF
File Size:
2.45 MB, 2449920 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.0.0 |
| Company Name | SmallDrop |
| File Description | SmallDrop |
| File Version | 1.0.0.0 |
| Internal Name | SmallDrop.dll |
| Original Filename | SmallDrop.dll |
| Product Name | SmallDrop |
| Product Version | 1.0.0 |
File Traits
- VirtualAllocExNuma
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 6,919 |
|---|---|
| Potentially Malicious Blocks: | 42 |
| Whitelisted Blocks: | 6,877 |
| Unknown Blocks: | 0 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.KYE
- Aotera.E
- Aotera.K
- Kryptik.OID
- Kryptik.PSB
Show More
- Trojan.Downloader.Gen.GJ
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
