Trojan.Downloader.Agent.BTW
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 13,455 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 32 |
| First Seen: | May 6, 2024 |
| Last Seen: | May 20, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Downloader.Agent.BTW on your system indicates a potential security threat. This name suggests a type of malicious software designed to download additional malware onto an infected computer, but without more specific information, it's crucial to understand the general behavior of such threats to take appropriate action.
Table of Contents
What Is Trojan.Downloader.Agent.BTW?
Trojan.Downloader.Agent.BTW, as indicated by its name, is likely a variant of Trojan downloader, a type of malware that specializes in downloading and installing other malicious programs on the infected computer. Trojans are known for their ability to disguise themselves as legitimate software, making them difficult to detect without proper security measures. The ".Agent.BTW" part of the name might indicate specific characteristics or behaviors attributed to this particular variant, but without further details, it's essential to focus on the general principles of dealing with Trojan downloaders.
How Trojan.Downloader.Agent.BTW Operates
Trojan downloaders typically operate by exploiting vulnerabilities in the operating system or applications to gain unauthorized access to the system. Once inside, they can download a wide range of malicious software, from keyloggers and ransomware to spyware and additional Trojans. These malware types can lead to various issues, including data theft, unauthorized access to the system, and significant performance degradation. The primary goal of a Trojan downloader is to establish a foothold on the infected system, allowing attackers to expand their malicious activities.
Symptoms of Infection
Symptoms of a Trojan downloader infection can be subtle and may not always be immediately apparent. Common signs include unusual system behavior, such as unexpected pop-ups, slow performance, and unfamiliar programs or icons on the desktop. In some cases, the system may become unstable, leading to frequent crashes or freezes. Since Trojan downloaders are designed to download additional malware, the symptoms can evolve over time as new malicious programs are installed.
- Unexplained changes in system settings or performance.
- Appearance of unfamiliar programs or toolbars in the browser.
- Increased network activity without a clear cause.
- Frequent system crashes or errors.
How to Remove Trojan.Downloader.Agent.BTW
- Boot your computer in Safe Mode with Networking to limit the malware's ability to interfere with the removal process.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all traces of the malware.
- Uninstall any suspicious programs or applications that were installed around the time the malware was detected.
- Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any malicious extensions or settings changes made by the malware.
- Reboot your computer and perform another full scan to ensure that all malware has been successfully removed.
Conclusion
Removing Trojan.Downloader.Agent.BTW requires careful and thorough action to ensure all components of the malware are eliminated from the system. It's also crucial to take preventive measures to avoid future infections, including keeping your operating system and software up to date, using strong antivirus protection, and being cautious when opening email attachments or downloading software from the internet. By understanding how Trojan downloaders operate and taking the necessary steps for removal and prevention, you can protect your system from these and other types of malware threats.
Analysis Report
General information
| Family Name: | Trojan.Downloader.Agent.BTW |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
0a0d9d35117de598856e2ebe622314a3
SHA1:
8f15a1ea784e284469b40c5c39b9eec340c6e750
SHA256:
4C7AC8A6CB83DA94FD50E1824D9ABF9E718D3B40172C21EA1DEF20ED57FC31DE
File Size:
332.80 KB, 332800 bytes
|
|
MD5:
59c61c009589c0edacf002b5b708d697
SHA1:
d775d814d1f0e54c21f9ba05fea625c07e19e694
SHA256:
1C8CD96DFB63AFDC4D20C06820919FB2D187C248825C971531A4957EEF60A2DD
File Size:
2.15 MB, 2151424 bytes
|
|
MD5:
51390039e63d71e3536c6aa2d8e783d0
SHA1:
3366abf88d13bc067b8561c7822a6c6a4b267e1a
SHA256:
B850FC86477E2A25DB746D20A0FB252054D55A549EFCFCD8DE9995B9238DF669
File Size:
337.92 KB, 337920 bytes
|
|
MD5:
9a1a43a71a5000431a81b5e9b90f253e
SHA1:
7d0296ea4ce7f776879914da7bf47f43bad6b24d
SHA256:
9B08BA206EFB119EAFE3FCB9CF6D0EB0BCABC7E23CDB491FCB614D5BB67609A2
File Size:
1.32 MB, 1321472 bytes
|
|
MD5:
0e8e390db9fac320e908b18f348b1d6c
SHA1:
dab76955ff3dc8b68f7240d4ae38343bd06c9d42
SHA256:
90828620FDD01D8E7AB43A756B78CCC0DEB536B2799B8BF14F1621F986C36164
File Size:
2.49 MB, 2490368 bytes
|
Show More
|
MD5:
b558b4be03694f4f4deef6515ef037e2
SHA1:
b3262029e1bfefb56996245134949fd9a6c669d8
SHA256:
0D33BCBE42CF5D65CBEEC03A4D66D52BAAB26CF827758C2157424FFB7F0C07BD
File Size:
337.92 KB, 337920 bytes
|
|
MD5:
c68fe33524e1701ff30e9fe25c199c10
SHA1:
b67332c17aa1ca261ad71ae9a73f894524273de2
SHA256:
9D741BC16606B788488A87D35E223DAE8676C441BEF5E08937E8BE105B190DC2
File Size:
9.96 MB, 9960960 bytes
|
|
MD5:
005af1bfc046c3a2b5d7a98727e57d8c
SHA1:
3572a87c1e678baae93dc9350c776bc437a2b9fd
SHA256:
D7294947CDF6F6DC765FB166711F86378DFB42B64FBA07B8F953477158CA0869
File Size:
1.41 MB, 1408000 bytes
|
|
MD5:
65237491fad5c51246d504e2a8780ce4
SHA1:
8d23c2347a9b30be2d96d76c1e3f3fd93dab6029
SHA256:
BB3AD960C09433D8A6A77247643269EAB2061FD6687AF35CE625FCAD2093430E
File Size:
1.17 MB, 1165824 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- fptable
- GetConsoleWindow
- HighEntropy
- imgui
- No Version Info
- ntdll
- VirtualQueryEx
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 3,336 |
|---|---|
| Potentially Malicious Blocks: | 108 |
| Whitelisted Blocks: | 3,201 |
| Unknown Blocks: | 27 |
Visual Map
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
?
0
0
0
?
?
0
x
0
x
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
0
0
1
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
x
x
0
x
0
0
0
0
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
0
0
0
0
0
0
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
1
0
0
0
x
0
0
0
0
0
0
0
0
0
1
0
0
0
x
x
x
0
x
0
x
x
x
x
x
0
0
0
0
x
0
x
0
x
0
0
x
x
x
0
0
0
0
0
0
0
x
0
x
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
x
x
0
0
0
0
x
0
x
x
x
x
x
?
0
0
0
x
0
0
0
0
0
0
0
x
0
x
0
0
0
x
?
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.ZFBJ
- CsgoInjector.FB
- CsgoInjector.GH
- Downloader.Agent.BAB
- Downloader.Agent.BTF
Show More
- Downloader.Agent.BTW
- Gamehack.EBB
- Gamehack.GACI
- Gamehack.GSH
- Gamehack.GYF
- Gamehack.PSJ
- Kryptik.EFJ
- Kryptik.LDA
- Trojan.Downloader.Gen.KB
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| c:\users\user\downloads\3572a87c1e678baae93dc9350c776bc437a2b9fd_0001408000 | Read Attributes,Synchronize,Write Attributes,Delete |
| c:\users\user\downloads\cjsmnujwl.com | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ᣂﻷ퀉ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ꇪă퀊ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | �u7l�� | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Network Winsock2 |
|
| Network Winsock |
Show More
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Other Suspicious |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"c:\users\user\downloads\CjSMnujWL.com" --restarted --oldpath="c:\users\user\downloads\3572a87c1e678baae93dc9350c776bc437a2b9fd_0001408000"
|
C:\WINDOWS\system32\taskkill.exe taskkill /f /im PerfWatson2.exe
|
