Trojan.Downloader.Agent.BTAS
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Downloader.Agent.BTAS |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
8c5f4ac12adaa99fee1db56d98e63ec5
SHA1:
0d78975787a0be4b5e4aeab9a9254b546430fbf4
SHA256:
AAC065C439687864E90B77171887F17257B41D1B7D5E34AD798588CE175BEAAA
File Size:
2.20 MB, 2204160 bytes
|
|
MD5:
f15a0f9cf95377a5e5a9bd8252c3e950
SHA1:
8523e02286ba6d300611bfb10932eaa7e9932cc5
SHA256:
718F0431AF0B0247B7FEC0594CC594A9003BA16BA7D35D4A2E3F91FCEFF079A7
File Size:
817.15 KB, 817152 bytes
|
|
MD5:
78d6bd857ba25260cee9081d5a783dc3
SHA1:
0ed7181c7dce0d7acc22c0d04d9f8494fa975b1f
SHA256:
663FE1EF10EEDAFD1B09947267B3FA40DBB9D69CC04B3BAE9391F544C8ADC9C0
File Size:
816.64 KB, 816640 bytes
|
|
MD5:
1f2ec767494ddc8e74be4c732bb58463
SHA1:
c73c3fa4c1d0ac9bf7b8b98f9bdc4eeb1a6aeaab
SHA256:
6E0C18D535AC05C5D3B8EB5B78245EDB2AB52565C24AFF6E19EFB14915E4B47C
File Size:
817.15 KB, 817152 bytes
|
|
MD5:
48a33bd6252d24ad0a13f119408c8fe5
SHA1:
92244fdb98d9b2b180125195ad56b0e328f7ecb2
SHA256:
4F3E4796BC8D5F877237A851B83EA1B7A6B2B2F569D2553A5B2081D18A8A79BB
File Size:
1.92 MB, 1924608 bytes
|
Show More
|
MD5:
fd87f904e6427c6209b1bff4e5007454
SHA1:
1fd1917b6fe3af7ae9498bb53d6c516b381ca3c0
SHA256:
1D100E7EA07A74CDBC2D82DDA8F2AA99AD6B685E4F043D0A296D3139A05E8790
File Size:
816.64 KB, 816640 bytes
|
|
MD5:
ffa4f036f8b7099767ee297f32ad861a
SHA1:
e57cd1faf345b1eb8a27bea6350bdd9dd0c4487c
SHA256:
FE0A5E50A97CD80151832E87E2C96293083733A248824FB404C5D406BFB1BDBD
File Size:
3.05 MB, 3053056 bytes
|
|
MD5:
a30cb2580ac963869cf7f3eba8891c53
SHA1:
9fe2bc7216b5936896b08347ea82104eccf53de7
SHA256:
CFD8395461E6EF978769D8003CC0122E97A789F4D5C838ED9B85B7DF4AA65076
File Size:
4.41 MB, 4405760 bytes
|
|
MD5:
a8b09e94e12bed5e6bada7d3adb8f118
SHA1:
36460e36cd100291791247a40942c0e38ed2ede3
SHA256:
69357F942FB4FA5AD4B5CED7D366732885FFF3472C262968C41078E03FED440F
File Size:
5.57 MB, 5572096 bytes
|
|
MD5:
2b8a97e9e668c2039c033bcf7a1f6a67
SHA1:
50aba2db945586e6840e57ef221151cc33301ca6
SHA256:
026F6E4E09F21318521A02147A66A08C33667C9D2CF1027E233B4ACFB2A64B6A
File Size:
817.15 KB, 817152 bytes
|
|
MD5:
0287c57e7e25f6fedc59819435f129b6
SHA1:
1af25eb76107cc7c1d9c773bc30d520f87322fd1
SHA256:
3405C2FBBB450C132593E00D85E44C8C73D6149F6AD8C6359A7D57F6C2D5990D
File Size:
5.55 MB, 5550080 bytes
|
|
MD5:
feadfe40423a0214d0ebf6e6300073b2
SHA1:
141a910e9752fbcd557a072b0c2080b58d07f56f
SHA256:
96FFF3498B6DBFB502B1EA511398611084311AEAC4883C0C719C0D3E307B2B02
File Size:
7.37 MB, 7369728 bytes
|
|
MD5:
bf0858c836ccbf93ed188baca013e8e3
SHA1:
71d262d616610c79d143100ab81d9d6bf471f7b1
SHA256:
F4A290ADACE544C83AFC40D547A012A933E8C1DD61EE7CDB6641A787F31DDAE0
File Size:
4.43 MB, 4431360 bytes
|
|
MD5:
34a437cee83e4e341f2167484e6d22cc
SHA1:
29826364abed355dddc27ef6a2183769fa58ec77
SHA256:
575896B489E56ECECBEFF95FC30683F8392E9BB08F2804185039A86178B1A072
File Size:
816.64 KB, 816640 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
Show More
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments | DOT EXE PREMIUM OB51 |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Legal Trademarks | DOT CORPORATION |
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- dll
- imgui
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 969 |
|---|---|
| Potentially Malicious Blocks: | 8 |
| Whitelisted Blocks: | 961 |
| Unknown Blocks: | 0 |
Visual Map
0
0
x
0
0
0
0
0
0
x
x
0
0
x
0
0
0
x
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Downloader.Agent.BTAS
- Gamehack.GAGE
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
| Anti Debug |
|
| Encryption Used |
|
| Other Suspicious |
|
