Multi-License Discount Quote

Change Region

English
Threat Database Trojans Trojan.Downloader.Gen.DS

Trojan.Downloader.Gen.DS

By CagedTech in Trojans

Threat Scorecard

Popularity Rank: 6,399
Threat Level: 80 % (High)
Infected Computers: 60
First Seen: December 12, 2025
Last Seen: May 21, 2026
OS(es) Affected: Windows

Analysis Report

General information

Family Name: Trojan.Downloader.Gen.DS
Signature status: Hash Mismatch

Known Samples

MD5: a697adc5bd9c0c15d621e3594c48724a
SHA1: ce2cb78d19e29f891396d56e1d5f795b2c1275b5
SHA256: 75536143DF51DFE7CFF63A00F39F4C06D3CFD20E8690D388575ACA07220F7F72
File Size: 3.01 MB, 3009024 bytes
MD5: ee1d1d08c414943588650ef1f00f926e
SHA1: efd62a4aab10f3d45ce27d143041899871d67d52
SHA256: E9DC7FB284D0705ED47FF6F92B969D419762AF8FCC96A430DA1CA7D96C9BE7A9
File Size: 3.01 MB, 3009024 bytes
MD5: 8baed8d26802802f711d734d60b87082
SHA1: ecb94fa6b8e48070ca6014d2b8c35b46ef0e2689
SHA256: 5765547E5FC862A17F4E2B8F055459CDD17F2F19DD0A8F266C55AB858005DDB8
File Size: 3.01 MB, 3009024 bytes
MD5: 915f5d2ff10667c3571737ccac33c185
SHA1: 9a4e353dc40a11d41594ed9cb23ca14e359ab2d2
SHA256: 59D827698D5B3C270DBCF96127EE89162C39CF0B3FD7BCFFE7168FF08E57EDE3
File Size: 3.01 MB, 3009024 bytes
MD5: 33b4f8e883730aa802097c34d3a8d83e
SHA1: bb8663eeb8cd298fcc378890b93a8e01dabfca7c
SHA256: 75DFA77488380D7499B37189626DBA5EE39B582A2C64EE39C409132FEFBA783B
File Size: 2.58 MB, 2584280 bytes
Show More
MD5: 43aade263621969dfb07a05a1196ea01
SHA1: 5b7b827dba4aba00b5b9bc8ed31b7c5951352eb3
SHA256: F4B9F6A5EA1B078F64AE081E5795703ED19F1760DDE0D73B45EAF5F01612F899
File Size: 1.67 MB, 1668848 bytes
MD5: 4fc804d66a2fa9bfd34d514031adf102
SHA1: 01bf2297ecffafd10eb15500bc11af8c9866e5dc
SHA256: 9EE29C1ECC833703430D6DED8038048F1C0AC40D48CD65D7B4B4A4E0EAEB351D
File Size: 856.06 KB, 856064 bytes
MD5: 03e839b33430da7a7963fd0d375704bc
SHA1: 5e7fd42580a447bb51a8186b92fcffdc2f819a16
SHA256: 9BCA6597F4DBB246E0649316E337A169DCADC9E9FC208BE8974518692FDCD637
File Size: 1.94 MB, 1942200 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have security information
  • File has exports table
  • File is 32-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Comments http://www.iFoerster.com
Company Name
  • Apache Software Foundation
  • iFoerster Development
  • Nokia Corporation and/or its subsidiary(-ies)
  • The Qt Company Ltd
File Description
  • Apache log4cxx
  • C++ application development framework.
  • FoxBurner SDK
File Version
  • 6.4.2.0
  • 5.6.3.0
  • 4.8.2.0
  • 0,10, 0, 1
Internal Name
  • FoxBurnerMFC.dll
  • log4cxx
Legal Copyright
  • Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies).
  • Copyright (C) 2015 The Qt Company Ltd.
  • Copyright 2002-2012 iFoerster Development
  • Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Original Filename
  • FoxBurnerMFC.dll
  • log4cxx.dll
  • Qt5Network.dll
  • QtCore4.dll
Product Name
  • Apache log4cxx
  • FoxBurner SDK
  • Qt4
  • Qt5
Product Version
  • 6.4.2.0
  • 5.6.3.0
  • 0, 10, 0, 1

Digital Signatures

Signer Root Status
Shenzhen Jiehao Software Co., Ltd. DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 Hash Mismatch
Shenzhen Jiehao Software Co., Ltd. DigiCert Trusted Root G4 Hash Mismatch
AOMEI International Network Limited Sectigo Public Code Signing Root R46 Hash Mismatch
Garena Online Pte Ltd VeriSign Class 3 Public Primary Certification Authority - G5 Hash Mismatch

File Traits

  • dll
  • HighEntropy
  • imgui
  • x86

Block Information

Total Blocks: 5,024
Potentially Malicious Blocks: 3
Whitelisted Blocks: 3,902
Unknown Blocks: 1,119

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? x x ? ? 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 0 ? ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? 0 0 ? 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? ? 0 ? ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? ? ? ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 ? 0 ? ? 0 0 0 0 0 ? 0 0 0 ? 0 0 ? 0 ? 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 ? 0 ? 0 0 0 ? ? ? 0 ? 0 0 0 ? 0 0 0 ? ? ? 0 0 0 0 0 0 ? 0 0 0 ? ? ? 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 ? 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? ? 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 ? ? 0 ? ? 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? ? ? 0 ? 0 0 0 0 ? 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? ? 0 0 0 0 0 ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 ? ? 0 ? ? 0 0 0 1 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 ? ? ? ? 0 0 0 0 ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 ? 0 0 ? 0 ? 0 ? 0 0 0 ? 0 0 0 0 0 ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? ? 0 ? ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? 0 ? 1 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 1 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 ? ? ? ? 0 ? 0 0 0 0 ? ? 0 0 ? ? 0 ? 0 ? 0 0 0 ? 0 ? ? 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? ? ? ? ? 0 0 ? ? ? 0 0 0 0 ? 0 0 ? 0 0 ? 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 ? ? 0 ? 0 ? ? 0 0 ? ? ? ? 0 0 0 0 ? 0 0 0 0 0 ? ? 0 ? 0 0 ? 0 ? ? ? ? ? ? 0 ? ? ? 0 ? 0 ? ? ? ? ? ? ? 0 ? 0 ? ? 0 0 0 0 1 ? 0 0 ? 0 ? 0 ? ? ? 0 ? ? ? ? 0 0 ? ? 0 ? 0 ? ? ? 0 ? 0 ?
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Rugmi.GI
  • Rugmi.IFB
  • Rugmi.TB

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtQueryAttributesFile
Show More
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWriteFile
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ce2cb78d19e29f891396d56e1d5f795b2c1275b5_0003009024.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\efd62a4aab10f3d45ce27d143041899871d67d52_0003009024.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ecb94fa6b8e48070ca6014d2b8c35b46ef0e2689_0003009024.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\9a4e353dc40a11d41594ed9cb23ca14e359ab2d2_0003009024.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\bb8663eeb8cd298fcc378890b93a8e01dabfca7c_0002584280.,LiQMAxHB
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5b7b827dba4aba00b5b9bc8ed31b7c5951352eb3_0001668848.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\01bf2297ecffafd10eb15500bc11af8c9866e5dc_0000856064.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5e7fd42580a447bb51a8186b92fcffdc2f819a16_0001942200.,LiQMAxHB

Trending

Most Viewed

Loading...