Trojan.Agent.M
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,817 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 1,821 |
| First Seen: | July 24, 2009 |
| Last Seen: | March 6, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Aliases
10 security vendors flagged this file as malicious.
| Antivirus Vendor | Detection |
|---|---|
| TrendMicro | PAK_Generic.001 |
| Panda | Generic Malware |
| McAfee-GW-Edition | Riskware.Agent.EZ |
| K7AntiVirus | Trojan.Win32.Malware.1 |
| Ikarus | Virus.Win32.Agent.YIC |
| eSafe | Suspicious File |
| CAT-QuickHeal | Trojan.Agent.irc |
| Avast | Win32:Agent-YIC |
| AntiVir | SPR/Agent.EZ |
| a-squared | Virus.Win32.Agent.YIC!IK |
Analysis Report
General information
| Family Name: | Trojan.Agent.M |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
6d2f61b2fcca7ad49edb4dd4c150623e
SHA1:
fff3961aff2ea64dd0f273051523abe6d42948ef
File Size:
22.53 KB, 22528 bytes
|
|
MD5:
03a8f69611d83066c6efe22b9043ec1f
SHA1:
3030c0e7f5aa0bce665f2de062559b30dd64717b
File Size:
5.97 MB, 5973096 bytes
|
|
MD5:
d5aaaee651aa52c6d6b5527787817f9b
SHA1:
bf7024e552756ff2645a0f5740640650db13ac8a
SHA256:
83B0C95EE4A387A34B17343282A79C9BD2BD7B88EA14A11F0B96186BB5043605
File Size:
20.99 KB, 20992 bytes
|
|
MD5:
e237f8915909633fabdc200e9a278603
SHA1:
61837785f4bd118b7f39d0075beaf03ec6dded94
SHA256:
8BB024CBC9AB6E7615FC99F8F5FF94FF29C00C88F1BD8ABED92FDBBB2AD1DEC3
File Size:
8.52 MB, 8517632 bytes
|
|
MD5:
0f283bbd13e49de44dac713c374986fd
SHA1:
893da38584f3502b979aa0306a469b854098a4f6
SHA256:
63C111A6BBD84CEE51E25933B0E8266B4BB3392A7F4BB391E74CC5DC42457635
File Size:
21.50 KB, 21504 bytes
|
Show More
|
MD5:
0bd8f4c21714bb5891243960024af856
SHA1:
a5dd8570c84a530d9c486b62fce680609f1c7bad
SHA256:
75FCDFC805AE4EBAA2D59B328E35A586056EC7B28621A43D4270FE4F5478D7FC
File Size:
20.99 KB, 20992 bytes
|
|
MD5:
e8e9afc75b640bb86e41537006233de8
SHA1:
9dfe229887a2cd96458424526b4d679ac909f231
SHA256:
676987B7781938A0F91BFF613C7926DDA490833A3894AA713E970D380EE0280F
File Size:
22.53 KB, 22528 bytes
|
|
MD5:
0251cd642b48780cfab8531d1f306146
SHA1:
d0b7d90ab9cdc1701ece21fd8e04fe0a9bad7cbc
SHA256:
E7D1159D5157523CD21DFAE1F90461FEA6F8C7A24E889AA291B9D14E044BD375
File Size:
33.82 KB, 33824 bytes
|
|
MD5:
fb872547f494bc20af01e9eadeb04516
SHA1:
48bfa2996267a3c69f0c059626af0185aabd54c0
SHA256:
F36857D23FB8C84A37B12820C964C24D5882425637C4DE129E22D01249191322
File Size:
3.51 MB, 3505504 bytes
|
|
MD5:
03cfd9894b1dc8f8bf4ee9250679189d
SHA1:
5da364b9cf44701b7f65d9dc37cb0fab2d818382
SHA256:
DFE8F1933D0993F7CF48A7C8343BF2B6EF24ADE66DF1267AA953725FB4ADAFCB
File Size:
246.08 KB, 246080 bytes
|
|
MD5:
a668e44cf9c21418781b8bb36fd56a24
SHA1:
bbeb9801763ce11b04a3912713671c7d2cf20c02
SHA256:
70F9597FE726F00A69383919F1D86C30001195D0C655640F94CBA9729E20C0AB
File Size:
21.50 KB, 21504 bytes
|
|
MD5:
e1cb0cb58d331d93418b12af5763eab1
SHA1:
d13ea12f26cbdc4888496cad4f18c36d35b6231f
SHA256:
1E947AC5AC3D19FF02354445C331931D8FB53C07ACA6FBD655B6FDBD8BDA25E3
File Size:
369.15 KB, 369152 bytes
|
|
MD5:
61af1f48854c4509b1874615cb5cd8f3
SHA1:
8b1565d24bad916c7309fb3423c420834f531d46
SHA256:
5570121E0743B754FA8E99B368FC3974E208E27C1971569B95058A74ACC35275
File Size:
1.21 MB, 1211392 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
Show More
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | This installation was built with InstallAware: http://www.installaware.com |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Jernej Simončič | COMODO RSA Code Signing CA | Hash Mismatch |
| Jernej Simončič | UTN-USERFirst-Object | Hash Mismatch |
| Zebra Technologies | VeriSign Class 3 Public Primary Certification Authority - G5 | Hash Mismatch |
File Traits
- 2+ executable sections
- big overlay
- HighEntropy
- Installer Version
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 525 |
|---|---|
| Potentially Malicious Blocks: | 10 |
| Whitelisted Blocks: | 402 |
| Unknown Blocks: | 113 |
Visual Map
?
0
0
?
?
0
?
?
0
?
0
?
?
0
0
0
0
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
?
?
?
0
?
?
0
?
0
0
?
?
?
?
?
?
?
?
0
0
0
0
?
?
?
?
?
0
0
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
0
0
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
?
?
?
?
0
0
0
?
0
?
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
0
0
0
0
0
0
?
?
?
?
0
?
0
0
?
?
?
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
?
?
0
?
?
?
0
0
?
?
?
0
0
?
?
0
0
0
?
0
0
?
?
?
0
0
?
?
?
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
?
0
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
0
?
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
2
1
0
0
x
0
x
x
x
0
x
x
x
x
0
x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\ksgsdk\log\ksdkhelper.log | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\windrx.txt | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Shell Execute |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
open
|
