Trojan.Agent.LKFB
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Agent.LKFB |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
e26fb158b5eb0f35c501ba7804955dec
SHA1:
0b7c00a3c97a61f1dc434c70afda09f9f3b24e03
SHA256:
79A7C0EAADDDFC715089BE7E01DFFC9E28386C0F478209D630423A8AFE88D358
File Size:
7.16 MB, 7158272 bytes
|
|
MD5:
e1dce60f54c43daa4ba3d862bd70e470
SHA1:
63b710afd02a200e0e8eb924f38065ae3e1fb75d
SHA256:
FEC9F7021F48631BABC04435ACE14B07E8FCED0FDE3304786BB4F06E15000176
File Size:
7.15 MB, 7152128 bytes
|
|
MD5:
a5e62f94df69ff21b98873733013a50a
SHA1:
e9f801afa21f22302d40c6f7499e421225b1f3b2
SHA256:
1E9C806676B8D6EBE02DC0833BAB86F97D9BC750762EB1A531F1C94A844AF472
File Size:
6.62 MB, 6618112 bytes
|
|
MD5:
df11ee1863e89f89c5d0c89de8b8cac3
SHA1:
516f9d45a5095d05cde7906b8e653d9afe402607
SHA256:
96870D6E416470F053B91777E22F1D859AD19EEE0FD2DF816DF3ECEBE9560CF7
File Size:
7.14 MB, 7142400 bytes
|
|
MD5:
00615f1a46899c659ad9582f43489f9f
SHA1:
bec3e4bd5ce7de11dca42697f31d094c0f54ded5
SHA256:
2BE97A48015544620FE1E3BB69B130A24DDBB31F9719173868579DF489E9356C
File Size:
6.62 MB, 6620160 bytes
|
Show More
|
MD5:
0ee1d17ea5d7c72754d9f772aa326e8d
SHA1:
212a186812c337a768c153bb08f8410baed7e9ce
SHA256:
D42FD17628467ED0ACBCFEE539562AE9CF45EA37F30E3EE07D7A41A8C8999512
File Size:
7.14 MB, 7144448 bytes
|
|
MD5:
48cfa1d016f73b400f5b1d29a1573257
SHA1:
0476fb4433cd745cba46347ebd045dcba50a54ff
SHA256:
68ED1EF9CE120358139C7B4621CC757D42C30B603DFAB630B13D46720032301B
File Size:
7.15 MB, 7152128 bytes
|
|
MD5:
886cdc0303280c5fb46c63f8c495ed1c
SHA1:
236ac98c9a3358eae2d247c93c16cc716c847c78
SHA256:
4D2FEE5493691FEB9E68F0A29AF1DF7624DA62F1B5229051A29A347021231752
File Size:
7.14 MB, 7142400 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- dll
- fptable
- HighEntropy
- No Version Info
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 3,134 |
|---|---|
| Potentially Malicious Blocks: | 279 |
| Whitelisted Blocks: | 2,431 |
| Unknown Blocks: | 424 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
?
?
?
0
0
?
0
?
0
0
?
?
?
?
0
0
?
0
0
0
0
0
0
0
0
1
?
x
?
0
?
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
?
?
?
?
0
?
?
x
?
0
0
0
0
0
?
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
0
0
0
0
0
1
0
0
0
0
0
?
0
0
0
0
0
0
0
0
?
?
?
0
0
0
0
0
0
x
0
0
0
0
0
x
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
?
0
?
0
0
0
0
0
?
?
?
?
0
0
0
0
?
?
?
0
0
0
0
0
0
?
1
?
0
?
?
0
?
?
?
0
0
0
0
0
0
0
0
?
?
?
0
0
0
0
0
0
0
?
0
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
x
0
x
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
1
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
?
?
0
?
0
0
?
?
?
0
0
0
0
x
0
0
?
0
0
2
0
0
0
0
0
0
0
x
0
0
0
1
0
0
0
0
?
1
0
1
2
0
0
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
0
?
0
0
0
0
0
0
0
0
?
?
?
x
0
0
0
0
?
?
0
0
0
?
?
?
0
0
?
x
?
?
?
?
0
0
0
0
0
0
0
0
0
1
?
0
0
0
0
0
?
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
?
0
?
?
x
0
0
?
0
?
1
0
0
?
?
?
?
x
?
?
?
0
0
0
?
0
?
?
?
0
0
0
0
0
x
?
?
0
0
?
0
?
0
?
?
?
0
?
?
?
?
?
0
?
?
0
0
0
?
0
0
0
0
0
?
0
0
?
0
?
0
0
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
?
0
?
0
0
x
0
0
0
0
?
1
x
?
?
?
x
0
x
x
x
0
x
x
0
0
?
?
0
?
x
1
?
?
?
0
?
0
?
1
x
?
x
0
0
0
0
0
0
0
0
x
0
0
0
0
?
?
0
0
?
x
0
x
x
1
?
0
0
0
0
0
x
0
0
x
1
x
0
0
0
?
?
?
0
0
0
0
0
0
0
?
?
0
x
0
x
0
x
x
0
0
x
0
?
?
?
?
?
?
?
0
0
?
0
0
0
0
0
0
0
?
0
?
x
?
?
0
0
x
0
?
0
0
x
0
0
0
1
0
?
?
x
0
?
0
0
0
0
0
0
0
0
1
x
0
0
0
x
x
?
0
0
0
?
x
x
?
0
0
0
?
0
0
0
0
0
0
0
?
1
?
?
x
0
x
?
0
?
?
0
0
0
x
0
0
?
0
0
?
0
0
0
0
0
0
0
x
x
0
x
0
?
0
0
?
?
0
1
?
0
0
0
0
0
0
0
x
0
?
?
?
0
x
x
x
x
x
0
0
0
0
0
x
?
?
0
x
0
0
x
?
0
0
0
?
0
0
0
0
0
0
0
?
?
0
?
?
0
0
x
x
?
0
0
x
x
0
?
0
0
0
0
?
0
0
0
?
0
0
0
0
0
0
0
0
0
1
0
?
0
0
0
0
0
0
0
0
x
x
0
0
0
x
0
?
x
x
0
0
x
0
0
0
0
x
x
0
0
?
0
0
0
x
x
x
x
1
?
?
0
?
0
1
0
x
?
0
0
0
?
0
0
0
?
?
x
?
?
?
0
0
x
0
x
?
x
0
?
?
x
?
?
0
0
x
x
x
0
0
0
x
?
x
?
?
0
?
0
?
?
0
0
?
0
?
x
x
0
0
0
0
0
0
x
?
x
0
0
1
0
0
0
?
?
0
0
0
0
0
?
?
0
1
?
0
0
?
0
0
0
0
0
0
0
0
x
x
x
0
?
0
x
0
x
?
?
?
0
0
x
0
0
0
0
0
0
?
0
0
0
0
x
0
?
x
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
x
x
?
0
0
0
x
?
x
0
?
?
?
x
0
?
0
x
x
?
?
x
?
?
?
0
?
?
?
x
x
0
x
0
x
?
?
0
?
x
0
0
x
?
0
0
0
0
?
?
x
0
x
0
0
0
0
0
0
?
0
0
0
0
?
0
?
0
0
?
0
?
?
0
x
0
?
x
?
0
0
x
?
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
?
0
1
0
0
?
0
x
0
?
?
?
?
?
?
?
?
0
?
?
?
0
?
?
0
0
0
0
?
?
?
?
?
0
0
0
1
0
0
x
x
?
x
x
0
?
0
?
x
0
0
0
0
?
?
0
0
0
0
0
0
0
?
?
1
0
0
?
?
?
0
0
0
?
0
0
?
0
0
0
0
0
?
0
0
0
0
?
x
0
1
0
?
0
0
?
x
?
0
0
0
0
0
0
?
0
?
0
?
0
0
0
?
0
0
0
0
x
?
0
?
0
?
0
0
0
?
0
0
0
0
1
0
?
0
?
x
0
0
?
x
?
1
?
?
?
0
0
0
0
0
0
?
0
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
x
?
?
x
0
0
0
?
0
?
0
0
1
0
0
0
0
0
0
0
x
0
?
0
0
0
0
0
0
0
0
0
?
x
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
?
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
?
?
?
?
x
0
?
0
?
x
?
?
0
0
?
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
?
?
?
?
?
?
?
0
?
?
0
?
?
?
?
?
?
x
?
?
?
0
0
?
0
?
?
?
?
?
?
?
0
0
?
?
?
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
?
?
?
?
0
?
?
?
?
?
?
0
0
0
0
0
x
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
x
x
0
x
0
0
0
0
x
x
0
x
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
x
x
0
0
0
0
0
0
0
x
0
x
0
x
x
x
0
x
x
x
0
x
x
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
x
0
0
0
0
0
0
0
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
x
x
x
x
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
x
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.CLAC
- Agent.KFS
- Agent.LKFB
- Coinminer.LFB
- Marte.CO
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\windows\system32\svctrl64.exe | Generic Write,Read Attributes |
| c:\windows\system32\u775659.dll | Generic Write,Read Attributes |
| c:\windows\system32\wsvcz\wlogz.dat | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\control\session manager\power::hiberbootenabled | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 尵䢬ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 尵䢬ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\u775659\parameters::servicedll | C:\Windows\System32\u775659.dll | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\svchost::dcomlaunch | Power LSM BrokerInfrastructure PlugPlay DcomLaunch SystemEventsBroker DeviceInstall u775659 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Service Control |
|
| Anti Debug |
|
| User Data Access |
|
| Process Terminate |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Windows\System32\svctrl64.exe"
|
cmd.exe /c timeout /t 5 /nobreak && del /q "c:\users\user\downloads\0b7c00a3c97a61f1dc434c70afda09f9f3b24e03_0007158272"
|
WriteConsole: 'timeout' is not
|
