Trojan.Agent.RTA
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Agent.RTA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
138a926e789be2c2de3e21311d7765ef
SHA1:
36dbd9f70100b7987e216ee014e4a095d7d9e063
SHA256:
4BE27B1519EB96CB4FA9D5E4EBD84F0421D87A032844EAF441DCC36FE9167EA4
File Size:
145.41 KB, 145408 bytes
|
|
MD5:
f521e5c6093727cb932e77586f09e95e
SHA1:
c71a0d28f128fc54ca98146e3835ab63df260c44
SHA256:
E1063BD7B402D5F8F80F6CF84BEA4BD1DE211AB7871AE12F56AF95B2C55E7425
File Size:
152.06 KB, 152064 bytes
|
|
MD5:
9730771f666a97d889e35026ea84d42c
SHA1:
011c34e68abb9fa7a39f8be838e345868e34dd65
SHA256:
EF5224234CC453C6DCE9C1B8BF79B6273E8EAA0D6BB90F90D660E98AFBA6C2A4
File Size:
154.11 KB, 154112 bytes
|
|
MD5:
2c8ee42c6155ac324792dbbdada8f26c
SHA1:
3a5b44e265b5238403c0ba733a9bfd5098f0ac54
SHA256:
DBF8FA1434A39B2C8D886E9A7924E2CBC8C4FCBB037EA3DCAA3E0432DF504EB6
File Size:
153.60 KB, 153600 bytes
|
|
MD5:
6cca583964120c47b62f462d4ee103ac
SHA1:
1d417f81f2fdc5b43711c0a6ae3a2c464896f8cd
SHA256:
C1067626845E10FCC1E1BEF49FAF7ADDB46ECC2584A5C0C9AA16A4B124DF2402
File Size:
154.11 KB, 154112 bytes
|
Show More
|
MD5:
9b35114a6aff0c3a87cc9fcce5380229
SHA1:
b018cf20943eca376ac59e28f6b95d3c3843d33e
SHA256:
5C5E42D7FBE116F73F61BA9B91C2A6CA3D25466AE9DA8DE5E83282A70AEED33A
File Size:
145.41 KB, 145408 bytes
|
|
MD5:
f10275692ead7b57175931101e09fe2f
SHA1:
c4d7d550465dd5b1b28b2b59a9047f42a354691f
SHA256:
77CE6F80EDB8836C1FD05307FD29C27DE28B0FB1592CE7F452B7426D73E096E1
File Size:
2.05 MB, 2046464 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- No Version Info
- ntdll
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,936 |
|---|---|
| Potentially Malicious Blocks: | 280 |
| Whitelisted Blocks: | 2,219 |
| Unknown Blocks: | 437 |
Visual Map
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
?
?
?
?
?
0
?
?
0
0
?
?
0
0
0
0
?
0
?
0
?
0
0
?
0
0
?
?
0
0
?
?
0
0
0
?
?
0
0
?
?
0
0
0
x
?
?
?
0
?
?
?
0
?
?
?
?
?
?
0
?
0
?
0
0
?
?
0
0
?
0
?
0
?
?
0
0
?
?
?
?
?
0
0
?
?
0
?
0
?
0
x
?
?
?
?
?
?
0
0
?
0
?
0
?
?
?
0
?
0
?
?
?
?
0
?
0
?
?
?
?
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
0
?
?
?
0
0
?
?
?
?
?
?
0
?
?
?
?
0
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
?
?
?
0
0
?
0
?
?
0
?
?
?
?
?
?
0
0
0
?
?
?
?
x
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
0
?
0
?
0
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
0
?
?
?
?
?
1
0
?
?
0
?
0
?
0
0
?
0
?
?
0
?
0
0
?
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
?
?
?
?
0
0
?
?
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
x
0
0
?
?
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
?
?
0
0
x
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
?
0
0
?
0
?
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
?
0
x
0
0
?
0
0
0
0
0
x
?
0
0
0
0
?
0
x
0
?
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
0
0
0
0
?
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
0
0
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
1
0
0
0
0
?
?
?
0
0
0
x
0
0
0
0
0
0
0
0
x
x
0
x
x
0
x
x
0
0
0
x
x
0
0
x
0
0
0
0
x
x
0
x
0
0
0
0
x
0
0
0
x
x
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
x
0
?
x
0
0
0
x
x
0
0
1
x
0
x
0
x
0
0
0
0
x
0
0
0
0
0
0
x
x
x
0
0
0
0
x
x
0
0
0
0
x
0
x
0
x
0
0
0
x
0
0
0
0
0
0
x
x
1
0
0
0
0
x
0
x
0
0
x
0
x
x
0
0
0
0
0
0
0
x
0
0
0
?
?
?
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
x
x
0
0
x
?
0
0
0
x
0
0
0
0
0
0
0
0
x
x
x
0
0
0
x
0
x
0
0
?
x
?
0
x
0
0
0
0
0
0
0
0
0
1
0
0
x
x
1
x
x
0
x
0
0
0
0
0
0
0
0
?
0
0
0
1
x
0
0
1
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
x
0
0
0
1
0
x
0
0
0
0
0
x
0
x
x
0
0
0
x
0
0
0
x
x
0
0
0
0
x
x
0
0
x
0
x
0
0
x
0
x
0
0
x
x
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
x
0
0
0
x
?
0
0
0
?
0
?
0
x
0
0
0
0
0
x
0
0
0
0
0
x
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
x
1
x
x
x
0
0
x
0
0
x
x
x
x
x
0
0
0
0
0
0
x
0
x
0
0
x
0
x
0
0
1
0
?
?
0
0
0
0
0
0
0
0
0
0
0
1
0
0
x
0
x
0
x
0
0
0
x
?
0
1
0
?
0
0
0
1
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
x
x
0
0
?
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
1
x
0
0
1
0
0
1
0
0
0
0
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
x
0
?
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
x
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
x
x
x
x
0
x
x
x
x
x
0
x
?
?
x
0
x
0
x
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
?
0
0
0
x
0
x
x
0
0
0
x
x
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
?
?
0
?
0
?
0
?
?
?
0
0
0
?
?
0
0
?
?
0
0
?
0
?
0
?
?
0
?
?
?
0
?
0
?
0
0
0
?
?
?
?
0
0
0
0
0
?
?
0
?
x
x
0
1
?
?
?
0
0
0
x
0
0
?
?
0
0
?
?
?
x
0
0
0
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
?
?
0
?
x
0
0
?
0
?
0
x
0
0
?
?
0
0
0
0
0
0
0
0
0
0
?
0
0
?
0
?
0
0
0
0
0
?
x
x
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
x
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\pshost.134205973625313723.8060.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_ga44zreq.ajn.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_z5zr1cdc.0dn.psm1 | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 䚛㢜쮟ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
7 additional items are not displayed above. |
| Network Winhttp |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| User Data Access |
|
| Encryption Used |
|
| Other Suspicious |
|
| Anti Debug |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
|
