Trojan.Confuser
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 6,428 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 37,383 |
| First Seen: | June 23, 2016 |
| Last Seen: | January 13, 2026 |
| OS(es) Affected: | Windows |
Trojan.Confuser is a threatening software capable of injecting into a system. Computer users that encounter Trojan.Confuser on their machines may see fake warnings claiming that their machines have been infected by a virus. Trojan.Confuser may change permission policies and also may modify the Windows Registry. In many cases, Trojan Confuser ends up being installed because the user doesn't realize it has a harmful intent. The distribution of this threat is likely related to false Windows updates, as well as to the installation of third-party programs made to view a Web page and videos, the download of third-party applications, clicking on banners and advertisements, as well as the download of attachments or files through social media.
Trojan.Confuser also may display warning messages describing corrupted Windows system files. The removal of such files may compromise the affected systems, or even crash them. Computer users should keep in mind that these scan results and the problems described in the pop-up messages are fake. Trojan.Confuser also may disable installed software on your PC, such as anti-virus application or even the Windows firewall. The browser settings also may be affected so that it may hide its presence in a system. Trojan.Confuser may show security alerts similar to the ones listed below:
"Warning: Your computer is infected
Detected spyware infection!
Click this message to install the last update of security software…"
Table of Contents
SpyHunter Detects & Remove Trojan.Confuser
File System Details
Trojan.Confuser may create the following file(s):
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | bc778096cbd0260b2b4d5a4931dfdbe6a09d4712ab54290d39852873a4fd54d7.exe | dfc92c2b44197cbd31ecbc2cf9b3d3e4 | 0 |
| 2. | be015b82d26363865a66f6a8bb13325d2336380f2baf2a788590248cbebe21d3.exe | 14e7d346a4cf84a1f9eb9b2597df6546 | 0 |
| 3. | be9e5c498af836408c1e1b9cddb8a9c81ae7ecf430d4a3ec30c01ae518bc79b7.exe | 6f9a5bd7eb29ce2dfa0bdebcd67f46d9 | 0 |
| 4. | c0e2e7f0989e124cc6a1e7bbeb2f7b957fb289ed4e25d2d0dedbc41dc1f5c26b.exe | 8b1a05dd2a6fbca0e3a10b8e2cd09f23 | 0 |
| 5. | c49a6f05071298007326a4c221b872ae9d582452393f402768815f6e2947305f.exe | 5938c7a78bd8ac0f6da4e36dd5c53ce0 | 0 |
| 6. | c7535711d7359f1f6d48890511e1289dd22782ba7c69f34668919486f6cd098c.exe | 777a398549ca7c69afe5759c45f8598c | 0 |
| 7. | cef61e982c02a15d00b3a7d85ae8573118ea7e8ce8ad70402d30d93d9370b898.exe | 31d6b13bfbab916dc5d0112328d86587 | 0 |
| 8. | cfe872ff691941b060d0d41381b4e9e13610fe3ab5b5d08286ca82459ad6380d.exe | 78098bdaf0b0ddff9fef88960835b988 | 0 |
| 9. | d7d3204e09eb3e183051038e8525ce5877c4f81fc70e8f176c88e14261f086c8.exe | 46b8db50ae52dd1b451c263a0bf1150f | 0 |
| 10. | d7f435d40ff2fae1e49141dcbee7a6f671373423f6aff22171357b9a48c4afd2.exe | adec26e229ca25443396617b5d4d1474 | 0 |
| 11. | d8565efb5a6441229c41a6c80d548380ad4c26438a21636f5d77e2c1b51ba1f9.exe | b5d5991d99587744592f28fca9960606 | 0 |
| 12. | d888c841d7b979a2aec3ebd265b489b1965cb568fa064d92d79e2f25118e92d5.exe | c8e38592bcb704c4337d2db46bce4645 | 0 |
| 13. | d8ca8ac4ec0846c34bb06a9c6368296d28cea588ebb2cfd1335515da4ae76c3a.exe | dc763d9959839dda2616198d8e0bf4d4 | 0 |
| 14. | dcc7f88e28eb75a8db07dea002c6eda2584d5ccad4f69b72dbfc017e5b2b875d.exe | 946c860ddc996e8c6969f12397ca3d81 | 0 |
| 15. | dee4969b61b07d24acfdc8d38daca90783ec6e2dc08daee1b5095c0bbebacd67.exe | 05fbbd2fd3c8b98d6f1d2d60ab35b7dd | 0 |
| 16. | e46c0b5285fd3c04496932dc405b1c88002749abdc8675d6521dfb35f1f47471.exe | 265cd2eac1f8c9e2e9fa1cb7e59de100 | 0 |
| 17. | e6161e86869242da60e98d3cff52c4b0e6c739a8650da10660ce5f19d506f947.exe | b27e41a51818158a8866c85de9ced574 | 0 |
| 18. | eab4544c153dce3622b449ea85fee75dd151be830eec398ae3d17aeac928bd3c.exe | 99d90f1717ee991bb9c7aae0265839f0 | 0 |
| 19. | eb2df73ecf8aed9b248d8c6cfc103077457f37532f773aaa297d090ffaada0c6.exe | c7ba6fd5e3f142b304b7f0f311c8579d | 0 |
| 20. | eefa926445878afa0f36dd546df5f71fca49e934ce2c40e96e182883a24e7a4a.exe | b058088e29a1027092ae08ae3777f149 | 0 |
| 21. | f391e0ce4523c310b3f7898c96f559cf8a437ea2e3183426e7d3e0de68c4ce40.exe | e7b24f1e47189e9e43680a5159a095ec | 0 |
| 22. | f7d78eb7144b3e9bcc0c533cdc27f2865fc817bd96b6e6632ee361d82df1d7f3.exe | b9507714db57e83f6c969c1d0b8f2237 | 0 |
| 23. | f80ecd329d779a9ba79de1a8760a7a4bd3ff31eae1dee67da21b096f6701fec8.exe | d610ee39c0f1b44d9326783c4e904e53 | 0 |
| 24. | fc294349abe736e05dbcdcda6fa66962cc64b6e535fcde5a359945dcd81fb51e.exe | 88a159817a4ddae335791e565c5eb269 | 0 |
| 25. | File.exe | deb6e3bbb758c32d146206788a670a63 | 0 |
| 26. | sxsx.exe | 41eee39843710adb58da43abf95437ab | 0 |
Registry Details
Trojan.Confuser may create the following registry entry or registry entries:
Regexp file mask
%TEMP%\trojan.exe.tmp
Analysis Report
General information
| Family Name: | Trojan.Confuser |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
9ebbe4f78a508707c98b11cb27ce3076
SHA1:
c03873c249c2f0bf7fc945ad1e155ee7f2023378
File Size:
59.90 KB, 59904 bytes
|
|
MD5:
1622cf46a2d785684706a888f554cba4
SHA1:
dc2268ff0e1884d53ea87bab46ea6b66c4e78350
SHA256:
1ED4A80F08E932ED21B1F3DE372286DDB93D76A7D4CF943A4C326EC80B56EA61
File Size:
2.21 MB, 2212864 bytes
|
|
MD5:
5dfae2b96d8bc6790c29ec2ac85afe99
SHA1:
db05a87beb16572c793142c9bc5e42e8cc37b063
SHA256:
DFCFDB44CD6A19CA1A215DEDD9B90962141D31369867983345E6550D2D750996
File Size:
6.89 MB, 6886400 bytes
|
|
MD5:
ccc24fa5f1bbb814e0c2544a73f806c7
SHA1:
105f091d0b90576748f58e92e11692f197d79bc1
SHA256:
999B6EFD21046A473816F0059FD07ED6D902C85D4AEBD978E81F629E4DEAE259
File Size:
5.30 MB, 5298688 bytes
|
|
MD5:
109d2c10f99e618a8b368f7b68e0d747
SHA1:
baccf9b1a60f48d08df01249a2d5b8db3f83345d
SHA256:
7DBAAE7A1111F93CC22784ECAF5E7D187EC1B8AB6B5525BBFA0D6B3460A37582
File Size:
165.89 KB, 165888 bytes
|
Show More
|
MD5:
dda653586f0f81afffba9daabe344b92
SHA1:
5d0b808bc05e3940341a5cefab00b0c6229ac483
SHA256:
D6D095EA74CD76D710EAC508CA73858FB1994624E78EC7B182C40B5592B490FB
File Size:
43.52 KB, 43520 bytes
|
|
MD5:
4e2d25aa502ee615e964aae0b9414d8e
SHA1:
e20c5c76eb738eab2c5d89c0bd1c597abb3ee961
SHA256:
C0DD63A6A61C2A02365485B7E1065EDF477B0132AED0709D2BBC37BEA7B5D62E
File Size:
571.39 KB, 571392 bytes
|
|
MD5:
24fad267137f2f094a4d62b367669b76
SHA1:
1b225ef76228362ef249638ef95e583fcad9457d
SHA256:
B5A720F4C814BE9B2C00D534913A850C3C14D07372E397B1FF849EF7BA55279E
File Size:
58.88 KB, 58880 bytes
|
|
MD5:
974d622c5e3f25b491ea3dabbf6b7909
SHA1:
bd6e5ffe363eab56ad959669b995ffa22544aca6
SHA256:
83DAC4C9836BD72D587849A8C1C5F99124094645618C98659AE061A41D6060F5
File Size:
956.93 KB, 956928 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments | Paches AIM 6.0 to work with Phoenix |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Legal Trademarks | CINEMA 4D ® |
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- .NET
- 00 section
- 2+ executable sections
- Confuser
- Goliath
- HighEntropy
- Installer Version
- ntdll
- SmartAssembly
- x86
Show More
- Yano
- ZYXDN
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 18 |
|---|---|
| Potentially Malicious Blocks: | 2 |
| Whitelisted Blocks: | 9 |
| Unknown Blocks: | 7 |
Visual Map
?
0
0
0
0
0
0
0
0
0
?
?
?
x
x
?
?
?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- HEUR.MSIL.Generic_268209
- MSIL.Downloader.Agent.IUE
- MSIL.Downloader.Agent.LC
- MSIL.Injector.XC
- MSIL.Small.FG
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\hulmoil\polmilh.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\db05a87beb16572c793142c9bc5e42e8cc37b063_0006886400 | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\downloads\tempfile | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\eventlog\application\gewatec::eventmessagefile | C:\Windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
| Encryption Used |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Anti Debug |
|
| Other Suspicious |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
c:\users\user\downloads\tempfile (NULL)
|
(NULL) C:\Users\Nfifkagk\AppData\Local\hulmoil\polmilh.exe
|
