Trojan.Agent.UIGA
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 5,757 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 34 |
| First Seen: | February 4, 2026 |
| Last Seen: | April 15, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Agent.UIGA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
dee5a19eec188f7ec99473bc8c586285
SHA1:
8524fee9d2fc4f641f5af18c4e00d182776a6c28
SHA256:
37DEA037D58B049248919C64E369A33FF5D315925D83FD2124F844088B236B06
File Size:
920.54 KB, 920538 bytes
|
|
MD5:
8e26596854ee84950e1cc6c2d1848c46
SHA1:
f58ad143c5aac012cf2596f5e2103a14c446408c
SHA256:
192D20D704CCF60EBF0BAC462F73E5F8F5AD91BA10FBFF0D0287A68DC882FB18
File Size:
9.85 MB, 9852096 bytes
|
|
MD5:
d97bce72fbc07d12712a16aa2fa8123d
SHA1:
73facc82c62b5a7b43d9c953ad57cacde1d1978b
SHA256:
12A45C261C70BAF9D3694C38DA7E4D89F6D2FEC3A0B3838F3566CFE2C50D21F4
File Size:
916.62 KB, 916620 bytes
|
|
MD5:
3eb196a30a76316f9f44fabf6b1ae105
SHA1:
b0732be0b01e8f4efc8035e58eabc73f8615e01d
SHA256:
FF324ADDD143F99FD7E0098D02DCC7CF337F8A1FBAFAE5E624A7392B9CD9FDF0
File Size:
1.21 MB, 1208800 bytes
|
|
MD5:
6a1b5be860cf07947f8b956729c82412
SHA1:
a8bfa07361fbecfbb8c898955dbaa7faf347d81a
SHA256:
123DAAB237EBDBB4D43957D6E4E870B95E850F9EE1D13D47D523927F5819858D
File Size:
1.48 MB, 1483884 bytes
|
Show More
|
MD5:
bd1c5793b0ce87d348dc2cc6512c4c5a
SHA1:
cc3ad3c44fd9352ea9a240a7d3896ccf1bbf3eda
SHA256:
D1AD023232B39F2405CD42F9369E84261FB766BE3C95875F0B8CB12B8F68D381
File Size:
1.68 MB, 1683144 bytes
|
|
MD5:
785e43b8d74c76e7936f414b7bd8b421
SHA1:
2141ccb316303683c37a3f0acf1a12de254fdd53
SHA256:
DA44BAEAC2D69FC2D8D3E03E95F3B302625FC7234206F572F513B14636EB76F2
File Size:
2.67 MB, 2673115 bytes
|
|
MD5:
6b994ea85f142514435e0ce75555983e
SHA1:
d1122747e6e5eecec0ef809b38b7264ecab63eeb
SHA256:
D0045377F72DD38ECE58F2193144FE2F40087B734EE9F5B24E5FA2FA8746A06E
File Size:
1.15 MB, 1145800 bytes
|
|
MD5:
599cb28806924673cb7f173fdaaac61e
SHA1:
d869f6b61610b502e9c240478ab952e456a7bf7a
SHA256:
15D7A2F36C893A23AF9A634933D549E96003043B1CC747A2172076B6B239F612
File Size:
945.73 KB, 945728 bytes
|
|
MD5:
3aceb95be51c13c5108ae6d60958f578
SHA1:
ca0e4776d45990d2460d2cf77d69d2e8db30bd6b
SHA256:
BAE90F224A10A8E4727BF9EBBC366D84E44040B5142C36CC685B0B51CA0AF4AB
File Size:
1.17 MB, 1172977 bytes
|
|
MD5:
019b8b4b734a75f0040d0e63390d445c
SHA1:
2fb90ccc8b19aaafbe9d1077b9dd58ff6cdbb1ec
SHA256:
F366948622CC741AAF56FF0FAC53DA6A435803C2234DB81D3583FC976919E91A
File Size:
3.91 MB, 3911408 bytes
|
|
MD5:
cc05a303c7817e038a2bb4c209419a4d
SHA1:
1f4673ef784146ee3a9cd5cef217ff17e6774993
SHA256:
13606520561EFBF7D789EF26A1EE5DB576CB9D602B2F27027FE79CC91FBC7EBC
File Size:
924.60 KB, 924596 bytes
|
|
MD5:
c665ac88e0bcd5d182fa57b9d838779b
SHA1:
5fd5d360b8959ae3df7eef28ffd92428d7a22843
SHA256:
588245D29BA13CA67732F104BDE477B4937C5A5A2A1F31C9A80C81E1543D2439
File Size:
943.92 KB, 943924 bytes
|
|
MD5:
9830c9e0ed79c6c219bbce35abbe0971
SHA1:
2410abf76d96ebc624945ade13e71ad97afb5164
SHA256:
2ED0C071ED82FC210219DDC3827075D75B565C0D9CA2802B393A5082D500D989
File Size:
948.74 KB, 948736 bytes
|
|
MD5:
8fbeed4efe7c00c5f657155dda757eb6
SHA1:
339a8212b5afeedb205e50e7a30851605ed4add6
SHA256:
67DE7C2290527091A94DABF154385046B5530023F1ECC431D1389C74FFFA8A7D
File Size:
1.16 MB, 1163792 bytes
|
|
MD5:
48e93d39acc1301f0a6618cc4767864b
SHA1:
d84c530ed8aa3a6f2bfb9913ca8e181e6fb84715
SHA256:
682EC4C09DC4E3146B9B5A0A6747426445BD0183A68902B506A536D05D1C8FFC
File Size:
921.14 KB, 921144 bytes
|
|
MD5:
755e4c468c03f7bb843de1f124df9994
SHA1:
fbeda59f4de7b4787b2a03f2b102e2ef589d150a
SHA256:
16477487DCABD96BFE805D0E98378516CBA21E75158908CB9D61C8D7A2037A9F
File Size:
5.93 MB, 5926686 bytes
|
|
MD5:
eac3a8ebf9509efc72a4816d8ed0bc62
SHA1:
1ed3f36fca61d16169484819757a49755b980c44
SHA256:
D2C0EE79BF7E4799A5C1910874AFBB121F9749BC387B6E31152624F990883778
File Size:
3.23 MB, 3234280 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
Show More
|
File Traits
- big overlay
- dll
- HighEntropy
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 184 |
|---|---|
| Potentially Malicious Blocks: | 20 |
| Whitelisted Blocks: | 95 |
| Unknown Blocks: | 69 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
x
?
?
0
?
?
?
0
?
x
?
?
x
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
1
0
?
?
?
x
?
?
x
?
?
?
?
?
?
x
x
x
x
?
?
?
0
?
?
?
?
x
?
?
?
x
?
?
x
x
x
x
?
?
?
?
?
?
1
?
?
0
x
?
?
0
?
0
x
?
?
?
x
?
?
0
?
x
?
?
?
0
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.LPI
- Agent.UIG
- Agent.UIGA
- Dropper.JOA
- Dropper.JOB
Show More
- Injector.SR
- Trojan.Agent.Gen.AMX
- Trojan.Agent.Gen.APP
- Trojan.Agent.Gen.BPG
- Trojan.Injector.Gen.FHZ
- Trojan.Injector.Gen.FKE
- Trojan.Injector.Gen.FND
- Trojan.Kryptik.Gen.DBD
- Trojan.Kryptik.Gen.DYP
- Trojan.ShellcodeRunner.Gen.IT
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\edge\blbeacon::failed_count | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\blbeacon::state | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\thirdparty::statuscodes | (NULL) | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\thirdparty::statuscodes | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
6 additional items are not displayed above. |
| Encryption Used |
|
| Process Manipulation Evasion |
|
