Trojan.Bitcoinminer.FD
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 5,249 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 17,834 |
| First Seen: | May 5, 2017 |
| Last Seen: | July 14, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Bitcoinminer.FD indicates a potential threat to your computer system. This report provides an overview of the threat, its operating characteristics, symptoms of infection, and steps to remove it from your system.
Table of Contents
What Is Trojan.Bitcoinminer.FD?
Trojan.Bitcoinminer.FD is a type of Trojan threat that may be designed to exploit system resources for unauthorized purposes, such as cryptocurrency mining. The name suggests a possible connection to Bitcoin mining, but the exact nature and capabilities of this threat are not fully understood without additional context. It is essential to approach this detection with caution and take immediate action to protect your system and data.
How Trojan.Bitcoinminer.FD Operates
Trojan-type threats, including Trojan.Bitcoinminer.FD, typically operate by disguising themselves as legitimate programs or files to gain unauthorized access to a system. Once inside, they can perform a variety of malicious activities, including data theft, system compromise, and resource exploitation. These threats often rely on social engineering tactics or vulnerabilities in software to infect systems. Understanding how such threats operate is crucial for taking effective measures to prevent and remove them.
Symptoms of Infection
Systems infected with Trojan.Bitcoinminer.FD or similar threats may exhibit a range of symptoms, including but not limited to, significant slowdowns in system performance, increased CPU usage without apparent cause, unexpected crashes, and changes in system settings or behavior. In some cases, the presence of the threat may not be immediately noticeable, making regular system monitoring and security scans essential for early detection.
- Unexplained increases in electricity bills due to high CPU usage.
- Overheating of system components.
- Appearance of unfamiliar programs or icons.
- Difficulty in executing tasks due to system lag.
How to Remove Trojan.Bitcoinminer.FD
- Enter Safe Mode with Networking: This will help prevent the malware from loading and make it easier to remove. Safe Mode starts Windows in a basic state, using a limited set of files and drivers, which can help you troubleshoot problems.
- Conduct a Full Scan: Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system. This can help identify and remove all components of the Trojan.Bitcoinminer.FD threat.
- Uninstall Suspicious Programs: Go through your installed programs and uninstall any that you don't recognize or that were installed around the time you suspect the infection occurred.
- Reset Your Browser Settings: Malware often alters browser settings. Resetting Chrome, Firefox, Edge, or any other browser you use can help remove unwanted extensions and settings changes.
- Reboot and Re-scan: After taking the above steps, reboot your system and perform another scan to ensure that all traces of the malware have been removed.
Conclusion
Removing Trojan.Bitcoinminer.FD requires a combination of technical knowledge and the right tools. By understanding the nature of the threat, recognizing symptoms of infection, and following a systematic removal process, you can protect your system and data from this and similar threats. Regular security updates, cautious internet browsing habits, and the use of reputable security software are key to preventing future infections. Stay vigilant and ensure your system's security software is always up to date to minimize the risk of malware infections.
Analysis Report
General information
| Family Name: | Trojan.Bitcoinminer.FD |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
13a4381abff35515e4daabe4dbab04a6
SHA1:
4903e8615b2870faf6cff545fdcece7a48d53c46
SHA256:
9E91937090A1A32EB4AE32DC199AF2047DF41C60AB1BFDB4E2102A48352EDC89
File Size:
1.07 MB, 1074696 bytes
|
|
MD5:
ddce5b17e452b0bfe3e5eefdd5ed64b1
SHA1:
fb6c58b96270ee8121ba6e4de7bf4008a9f2928d
SHA256:
1DD2C379120D8FF2788707BDEEF5079D88717253E7D8B8D7F809A7A664AF5249
File Size:
541.18 KB, 541184 bytes
|
|
MD5:
da05f465a1dae22532ce5c6361da592b
SHA1:
0d9ac25cbc80c93fec1e430c124c609a14af570c
SHA256:
1F42427B133B11762346B091F877CB7A9F87E0FF5C00DC1DC1CF045A33C285B1
File Size:
1.93 MB, 1925120 bytes
|
|
MD5:
a97c99b65d07f4f25ce5d1b36198379d
SHA1:
b13f13bd4382a7ee1161f3a79067e9cdf69ba069
SHA256:
8E443B112397C4F10FC8FD66616D2CD05921886618665D26226726AA9B995821
File Size:
2.58 MB, 2576384 bytes
|
|
MD5:
4d76120b409107743a06ab42eb3f2299
SHA1:
420937959ecccccaf85cf52c6e8d2f5d59a0f2c1
SHA256:
DC90CBE0584F4E9F5BE7293B2C33C5C331E47AA91FD7C0F2D8E425E34E1E3949
File Size:
1.06 MB, 1064960 bytes
|
Show More
|
MD5:
16dd5aff41dbaf162f5fb8b12fadb803
SHA1:
8a1bbf1c1f45f76fd553cac40d646fe14baf2198
SHA256:
10A9035B438B8433F5113027F878A7B7E64247B0A90D9CD17338D045E2363F55
File Size:
958.46 KB, 958464 bytes
|
|
MD5:
9817b4670acba46577d18c6c281078e7
SHA1:
711e4f32abae10caecdfe63151a94d4651b3b2f9
SHA256:
02771B39E318D20CDA3074CF97F8FE05B5A7625DFF40531AFB97A5223A12E66A
File Size:
1.97 MB, 1971712 bytes
|
|
MD5:
bb7891ff42dc26a767e5ef4ada76f1a9
SHA1:
2fae2c199fa908632decf7f0c0911500b11488d7
SHA256:
F6ECA1822FAFEF30978200FA2392596DABC2A8B7B0A86461D8F8305AD2111A09
File Size:
3.44 MB, 3436544 bytes
|
|
MD5:
373a5753b425914c94e480a824e69c72
SHA1:
ab0f60fe3d0913e9310afbf625681e628e071449
SHA256:
C76DF3920EDDC3CCAE29FA7332850CB512D87473BCCB642E07EA40C314570DD9
File Size:
4.55 MB, 4550656 bytes
|
|
MD5:
53ec13f9d082df312cf02005f3e336e1
SHA1:
56bd3e9a0cd562beb72d2566892be5e592aa8235
SHA256:
031B73E835C1C3D1759F99970094F44EC46DB4339C9A2B540C917CB47076A53A
File Size:
1.66 MB, 1658880 bytes
|
|
MD5:
c10d6134d3d7b3fbd776b4ed5046e857
SHA1:
ea0f18615810e82957d5b46e650dcd75fd365e3c
SHA256:
ABA73CE2C278E9CEE072A0541BF222127F4EC47FEBBD67A32384E3763C2068D2
File Size:
630.27 KB, 630272 bytes
|
|
MD5:
c8a583d1e888541a8372ed328a287769
SHA1:
a895413ee5bdb696c96965bff84ac152f6bf838f
SHA256:
3EFC65AA02CD4AC0B86F1E61D34B60F832EC98D61F3CA776BD65E235705626DA
File Size:
1.41 MB, 1411768 bytes
|
|
MD5:
2a2998a6b13cc23c6cc473df9c51ed3e
SHA1:
9df39d3a7831c7bd12fd8bbf8abd06c1cc4cbca8
SHA256:
E11617C828C35BED4663233F865A6B4B91240AB19B2A35F4DCE869AA45B615D2
File Size:
5.43 MB, 5427001 bytes
|
|
MD5:
1ccb9583042ffeb5116252b5b8b52bb5
SHA1:
d993ded712510d2aa880b9f701945db65ccc7c87
SHA256:
1A4FD174F2EF45D72038610C5DDE7F5F3BEF82F0AAB4C37E56E022ED369E0F5E
File Size:
1.90 MB, 1900544 bytes
|
|
MD5:
02b5ec7c03cdb95af2c2128e6ccc89f8
SHA1:
5555fa9ad528b5cc4cc6408ecf50038a6884d9a0
SHA256:
C41823EB7F221086117DD9E3EEAF1DBD21D77171B4618C16DEC11922A0F3E561
File Size:
2.77 MB, 2766336 bytes
|
|
MD5:
75cc74826b39ff789bc3dbee2e8b9a45
SHA1:
b7e4a8a68d830e9edce9b01393ac73f95318d841
SHA256:
F124C7F9C46012E11FA7CDA92B48DA2E94E3400891D36A9FADC481D0E2596B75
File Size:
1.38 MB, 1384448 bytes
|
|
MD5:
0a118aeffda937ce1e045571bf8dd85d
SHA1:
63e4734c9f0149acfba7bed4ab0f364236c464e5
SHA256:
E8E60677ED673DCE20D7E792EB0891EF8D8EA5B756E4EE264E4243F9DA74DE26
File Size:
4.91 MB, 4911104 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
Show More
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
|
| Company Name |
|
| File Description |
|
| File Version |
|
| Legal Copyright |
|
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Copyright(C) 2013-2026 51Cxsoft.com 版权所有 | Copyright(C) 2013-2026 51Cxsoft.com 版权所有 | Self Signed |
| JetBrains s.r.o. | thawte Primary Root CA | Hash Mismatch |
| JetBrains s.r.o. | thawte Primary Root CA | Hash Mismatch |
File Traits
- 2+ executable sections
- dll
- HighEntropy
- Installer Manifest
- MPRESS Win32
- Native MPRESS x86
- No Version Info
- packed
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 3,491 |
|---|---|
| Potentially Malicious Blocks: | 1,495 |
| Whitelisted Blocks: | 1,316 |
| Unknown Blocks: | 680 |
Visual Map
x
?
x
?
?
?
x
?
0
0
?
x
0
0
x
x
x
?
0
x
x
x
?
0
x
?
?
x
?
x
?
?
x
x
?
?
x
x
x
0
0
?
x
0
0
x
x
x
?
x
x
?
?
?
?
?
?
0
?
?
x
0
x
x
?
?
?
0
x
?
?
?
?
?
?
?
?
x
0
0
?
x
x
x
x
x
x
x
x
?
x
?
x
?
?
?
?
?
?
?
?
x
x
?
x
x
?
?
?
?
?
?
0
?
?
?
?
x
?
?
?
x
x
x
0
x
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
0
x
x
?
?
?
?
?
?
x
?
x
?
?
x
x
x
x
x
x
x
x
?
x
?
?
x
x
x
x
?
?
?
?
?
0
?
?
x
?
?
?
?
?
?
?
0
?
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
?
?
?
x
x
x
x
x
x
?
?
?
?
?
?
?
?
?
?
x
?
0
0
0
0
x
x
x
x
x
x
x
x
x
x
x
0
0
?
x
?
?
?
x
?
x
?
x
?
?
0
?
?
?
?
x
x
?
?
x
x
x
x
?
x
?
?
?
?
?
?
?
?
x
x
0
?
?
0
x
?
x
?
x
x
?
?
?
x
x
?
x
x
x
x
x
x
?
x
x
x
?
?
?
?
?
?
?
?
x
0
?
?
?
x
x
?
0
x
x
x
x
?
?
0
x
x
?
?
?
?
0
x
x
x
?
?
?
?
0
?
?
x
x
x
x
?
?
x
?
?
?
?
?
x
x
?
0
?
?
?
x
x
x
x
x
x
0
0
x
x
0
x
x
x
x
x
0
x
x
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
0
?
?
x
x
x
0
?
x
x
x
x
?
x
x
x
?
x
x
x
x
x
?
0
x
?
x
?
x
x
x
x
?
x
?
?
?
x
x
x
x
0
?
?
?
x
?
?
x
x
x
x
x
x
x
?
?
0
?
0
x
x
x
x
?
x
0
?
x
x
?
?
0
x
x
x
x
x
x
x
x
x
x
x
x
x
?
?
x
?
x
x
?
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
?
x
x
x
x
x
x
x
x
x
x
?
x
x
x
?
?
x
x
x
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
x
?
x
x
?
x
x
x
x
0
?
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
0
x
?
?
?
?
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
?
x
x
?
x
x
?
?
x
x
x
x
x
0
?
?
x
x
0
x
0
x
?
?
?
x
x
?
0
x
?
?
?
x
?
?
?
?
?
0
?
?
?
?
x
x
x
x
x
x
x
?
x
x
?
?
?
?
?
?
?
x
?
?
?
?
?
?
x
x
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
x
x
x
x
x
x
x
?
?
?
x
x
?
0
x
x
?
?
x
?
0
x
0
?
?
?
?
?
?
?
?
?
?
x
x
x
?
?
?
x
?
?
?
?
?
x
?
x
x
x
x
x
?
x
x
x
x
x
x
x
?
?
?
?
?
?
x
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
?
?
?
?
?
?
x
?
x
x
?
?
x
x
x
0
?
0
?
?
?
?
x
?
?
x
?
?
x
?
x
x
?
?
0
?
0
?
0
?
x
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
?
x
x
x
x
x
x
x
x
x
x
?
x
x
?
?
?
?
x
?
?
?
?
x
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
x
x
x
?
?
x
x
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
0
?
x
x
x
?
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
?
?
x
?
?
0
?
?
0
0
0
0
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
?
x
?
0
x
?
?
0
x
x
?
x
x
?
?
?
?
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
x
x
x
x
x
?
?
?
?
?
?
x
?
x
?
x
?
?
?
?
?
?
?
?
x
x
x
x
x
x
?
0
?
0
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
x
?
?
?
x
x
?
?
x
?
?
?
?
?
?
?
x
?
?
x
?
?
x
x
x
x
x
x
x
0
0
x
x
0
x
x
x
x
x
0
x
x
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
0
?
?
x
x
x
0
?
x
x
x
x
?
x
x
x
?
x
x
x
x
x
?
0
x
?
x
?
x
x
x
x
?
x
?
?
?
x
x
x
x
0
?
?
?
x
?
?
x
x
x
x
x
x
x
?
?
0
?
0
x
x
x
x
?
x
0
?
x
x
?
?
0
x
x
x
x
x
x
x
x
x
x
x
x
x
?
?
x
?
x
x
?
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
?
x
x
x
x
x
x
x
x
x
x
?
x
x
x
?
?
x
x
x
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
x
?
x
x
?
x
x
x
x
0
?
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
0
x
?
?
?
?
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
?
x
?
?
?
?
?
x
?
?
?
?
?
?
x
x
x
x
x
x
x
x
?
x
?
?
x
?
x
x
x
x
x
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
?
?
?
?
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
?
x
x
x
x
?
?
?
x
x
?
x
?
?
?
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
?
x
x
x
?
?
?
?
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
x
x
0
0
0
x
x
x
x
x
x
0
x
x
0
x
x
x
x
x
x
x
x
x
x
x
0
0
x
0
x
x
x
x
0
x
0
x
0
x
0
x
0
0
0
x
0
x
0
0
x
0
x
0
0
?
0
0
?
?
0
?
0
?
0
0
?
0
0
0
x
0
x
0
x
0
x
0
x
0
x
0
x
0
x
0
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
0
x
x
0
x
x
x
0
x
x
x
x
0
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
0
x
x
x
x
x
0
0
x
0
0
x
0
x
x
0
0
x
x
x
0
0
0
0
x
0
0
x
x
x
x
x
x
0
0
x
0
0
x
0
x
x
x
x
0
x
x
x
x
x
x
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
0
0
x
x
0
x
x
0
0
0
x
x
x
x
0
0
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Bitcoinminer.FD
- CoinMiner.BB
- Emotet.AAJ
- Emotet.AAL
- FlyStudio.CA
Show More
- Kryptik.FHE
- Tofsee.BP
- Upatre.WIA
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\program files\common files\system\symsrv.dll | Generic Write,Read Attributes |
| c:\programdata\synaptics | Synchronize,Write Attributes |
| c:\programdata\synaptics\rcxbf6d.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\synaptics\synaptics.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\programdata\synaptics\synaptics.exe | Synchronize,Write Attributes |
| c:\programdata\synaptics\synaptics.exe | Synchronize,Write Data |
| c:\users\user\appdata\local\temp\a1d26e2\a37df341ed0.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-3n66u.tmp\9df39d3a7831c7bd12fd8bbf8abd06c1cc4cbca8_0005427001.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\uttftia.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winsl | Synchronize,Write Attributes |
Show More
| c:\users\user\appdata\roaming\winsl\l1\24\2026 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\._cache_711e4f32abae10caecdfe63151a94d4651b3b2f9_0001971712 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\._cache_711e4f32abae10caecdfe63151a94d4651b3b2f9_0001971712 | Synchronize,Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | `$�!�:i�� +00�� � Gs]XM��� "�2� � FX D�' :D��exA-� � ��n��� � <��� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | k � 8��81��B�8 �6 �v y� �Z xy �� �a ۀT��� B� ����� 1���� �5����eeBx �<�� �� �R �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�x'�(�(X�)�`*J*9*�^+�[+��,=� ,��/9� /�� | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\run::synaptics pointing device driver | C:\ProgramData\Synaptics\Synaptics.exe | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | � xy * � /�� Y� d� kP~ � � �ރ �p ��^ �o � ee9 Vs} kP~ ��1 3 �� 7 � �� ﺃ e e�� � ��1 �� f e�� g � | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | k 8��81��B�8 �6 �v y� �Z xy �� �a ۀ�� T��� B� ����� 1���� �5����eeBx �<�� �� �R �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�x'�(�(X�)�`*J*9*�^+�[+��,=� ,��/9� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | k 8��81��B�8 �6 �v y� �Z xy �� �a ۀ�� T��� B� ����� 1���� �5����eeBx �<�� �� �R �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�x'�(�(X�)�`*J*9*�^+�[+��,=� ,��/9� | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
| Network Winsock2 |
|
| Service Control |
|
| Process Shell Execute |
|
| Process Manipulation Evasion |
|
| Network Winhttp |
|
| Network Wininet |
|
| Network Winsock |
|
| Syscall Use |
Show More
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
runas c:\users\user\downloads\._cache_711e4f32abae10caecdfe63151a94d4651b3b2f9_0001971712
|
runas C:\ProgramData\Synaptics\Synaptics.exe InjUpdate
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\2fae2c199fa908632decf7f0c0911500b11488d7_0003436544.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\56bd3e9a0cd562beb72d2566892be5e592aa8235_0001658880.,LiQMAxHB
|
"C:\Users\Icetxdor\AppData\Local\Temp\is-3N66U.tmp\9df39d3a7831c7bd12fd8bbf8abd06c1cc4cbca8_0005427001.tmp" /SL5="$602B8,5030701,54272,c:\users\user\downloads\9df39d3a7831c7bd12fd8bbf8abd06c1cc4cbca8_0005427001"
|
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5555fa9ad528b5cc4cc6408ecf50038a6884d9a0_0002766336.,LiQMAxHB
|
