Trojan.Dropper.Agent

By CagedTech in Trojans

Translate To:

Threat Scorecard

Threat Level:	90 % (High)
Infected Computers:	5,132

First Seen:	December 1, 2009
Last Seen:	January 23, 2026
OS(es) Affected:	Windows

What is a Trojan-Dropper?

A Trojan dropper is harmful software used to install malware, such as Trojans, onto a computer. It is typically disguised as legitimate software or an email attachment and once opened, it will download and install the threatening payload onto the system without the user’s knowledge. The purpose of a Trojan dropper is to allow attackers to access a victim’s computer and use it for their own ill-minded purposes.

The Harmful Actions Trojan.Dropper.Agent can Perform When Inside a Computer

Once inside a computer, Trojan.Dropper.Agent can perform a variety of harmful actions, such as:

1. Downloading and installing additional malware onto the system without the user’s knowledge or consent.

2. Collecting sensitive information from the system, such as passwords and financial data.

3. Modifying system settings to allow an attacker remote access to the computer.

4. Disabling security software or other programs that could detect its presence on the system.

5. Creating backdoors into the system that allow attackers to gain access anytime without being detected by anti-malware software or other security measures.

How Can I Get Infected with Trojan.Dropper.Agent

Trojan.Dropper.Agent can be spread through corrupted emails, websites, and software downloads. To protect yourself from becoming infected with this malware, it is crucial to take the following steps:

1. Avoid clicking on suspicious links or email attachments, even if you know their source.

2. Only download software from reputable sources; always scan downloaded files with anti-malware software before opening them.

3. Keep your operating system and other software updated with the ultimate security patches and updates.

4. Install a reliable anti-malware program on your computer and keep it updated with the latest virus definitions.

5. Be wary of any pop-up windows or messages that appear on your screen while browsing the Web, as these could be attempts to install threatening software onto your system without your knowledge or consent.

Is Trojan.Dropper.Agent Difficult to Remove?

Trojan.Dropper.Agent may be tricky to remove unless you have the right tools and know-how. The first step in removing this malware is to use a reliable anti-malware program to scan your system for any threatening files or programs. If any are found, they should be quarantined or deleted immediately. You also should make sure that all of your applications are up to date with the latest security patches and updates, as this can help prevent future infections from occurring. Finally, it is paramount to practice safe browsing habits by avoiding suspicious links and websites and only downloading software from reputable sources.

Aliases

15 security vendors flagged this file as malicious.

Antivirus Vendor	Detection
Panda	Trj/OCJ.A
AVG	Generic29.CHMH
Fortinet	W32/SPNR.0CJI12!tr
AhnLab-V3	Trojan/Win32.OnlineGameHack
McAfee-GW-Edition	Generic.dx!bg3z
AntiVir	TR/Agent.foh
ClamAV	Win.Trojan.Agent-56605
McAfee	Generic.dx!C4EC84ABE20C
AVG	Downloader.Banload.BOVA
Fortinet	W32/Banload.BOHQ!tr.dldr
AhnLab-V3	Win-Trojan/Downloader.807424.B
BitDefender	Trojan.Generic.KDV.369858
McAfee	Generic Downloader.x!gc3
CAT-QuickHeal	TrojanDownloader.Banload.bohq
AVG	Generic4.LYJ

File System Details

Trojan.Dropper.Agent may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	1295978.txt	c4ec84abe20cf919843fc536312f3704	68
Name: 1295978.txt MD5: c4ec84abe20cf919843fc536312f3704 Size: 12.28 KB (12288 bytes) Detections: 68 Path: %TEMP% Group: Malware file Last Updated: May 15, 2013
2.	zljlvtoxhmvM.exe	3d3fa33a21152778e7beeb970c1fd659	29
Name: zljlvtoxhmvM.exe MD5: 3d3fa33a21152778e7beeb970c1fd659 Size: 208.89 KB (208896 bytes) Detections: 29 Type: Executable File Path: %SystemDrive%\Users\<username>\AppData\Roaming Group: Malware file Last Updated: January 14, 2013
3.	chrome.exe	c29b21a176cab7466ffbe675c0925e8c	19
Name: chrome.exe MD5: c29b21a176cab7466ffbe675c0925e8c Size: 1.46 MB (1465344 bytes) Detections: 19 Type: Executable File Path: %PROGRAMFILES(x86)%\chrome Group: Malware file Last Updated: October 5, 2012
4.	CertPolEng.exe	09050857004e30fc1235827a82aa849c	10
Name: CertPolEng.exe MD5: 09050857004e30fc1235827a82aa849c Size: 6.65 KB (6656 bytes) Detections: 10 Type: Executable File Path: %APPDATA%\Microsoft\Windows\Templates Group: Malware file Last Updated: January 21, 2013
5.	w32ssl.exe	45db9e587c1f9669b73966416f068934	9
Name: w32ssl.exe MD5: 45db9e587c1f9669b73966416f068934 Size: 1.01 MB (1019904 bytes) Detections: 9 Type: Executable File Path: %WINDIR%\system32\spool\prtprocs Group: Malware file Last Updated: March 8, 2012
6.	urghr.exe	5d5c12035c7c57901eac52213def9699	9
Name: urghr.exe MD5: 5d5c12035c7c57901eac52213def9699 Size: 1.39 MB (1396736 bytes) Detections: 9 Type: Executable File Path: %WINDIR%\TEMP Group: Malware file Last Updated: November 14, 2011
7.	uchwcrmxwvqotpocurb.exe	4ccde9b3f3b494e6788002bb4405427b	8
Name: uchwcrmxwvqotpocurb.exe MD5: 4ccde9b3f3b494e6788002bb4405427b Size: 684.03 KB (684032 bytes) Detections: 8 Type: Executable File Path: %APPDATA% Group: Malware file Last Updated: January 31, 2013
8.	netbt.sys	de92dcb84adca3e205c3b2a9aeab72f3	5
Name: netbt.sys MD5: de92dcb84adca3e205c3b2a9aeab72f3 Size: 185.85 KB (185856 bytes) Detections: 5 Type: System file Path: %WINDIR%\System32\drivers Group: Malware file Last Updated: October 10, 2011
9.	8E5.exe	f99d3252c80e75dff7e9794df74ec094	5
Name: 8E5.exe MD5: f99d3252c80e75dff7e9794df74ec094 Size: 317.95 KB (317952 bytes) Detections: 5 Type: Executable File Path: %APPDATA%\Microsoft\B8ED Group: Malware file Last Updated: December 27, 2011
10.	CSHelper.exe	e2d3175c2aa981d09fd52c231db38215	5
Name: CSHelper.exe MD5: e2d3175c2aa981d09fd52c231db38215 Size: 192.51 KB (192512 bytes) Detections: 5 Type: Executable File Path: %WINDIR%\system32 Group: Malware file Last Updated: February 15, 2022
11.	HPIEAddOn.dll	e35bbcc732c34897917729c182915972	4
Name: HPIEAddOn.dll MD5: e35bbcc732c34897917729c182915972 Size: 221.18 KB (221184 bytes) Detections: 4 Type: Dynamic link library Path: %PROGRAMFILES%\Media Access Startup\2.0.0.1050 Group: Malware file Last Updated: May 8, 2013
12.	jingling.exe	b63961d271e74d1ee40e127245592ed9	4
Name: jingling.exe MD5: b63961d271e74d1ee40e127245592ed9 Size: 655.28 KB (655280 bytes) Detections: 4 Type: Executable File Path: E: Group: Malware file Last Updated: March 6, 2020
13.	msnmrg.exe	5de618b0b1454200b6f102ee8906efca	3
Name: msnmrg.exe MD5: 5de618b0b1454200b6f102ee8906efca Size: 183.8 KB (183808 bytes) Detections: 3 Type: Executable File Path: %ALLUSERSPROFILE% Group: Malware file Last Updated: March 27, 2012
14.	12.exe	285b32487b220e1897be111360024078	3
Name: 12.exe MD5: 285b32487b220e1897be111360024078 Size: 434.17 KB (434176 bytes) Detections: 3 Type: Executable File Path: %APPDATA% Group: Malware file Last Updated: March 1, 2013
15.	MediaSPace.exe	79b64e714a227e5d255b85f71877b9d7	3
Name: MediaSPace.exe MD5: 79b64e714a227e5d255b85f71877b9d7 Size: 1.96 MB (1967375 bytes) Detections: 3 Type: Executable File Path: %PROGRAMFILES(x86)%\MediaSPace Group: Malware file Last Updated: February 18, 2020
16.	Word.exe	b817ae9e2f4a4a0fb3fd417fe73ea971	3
Name: Word.exe MD5: b817ae9e2f4a4a0fb3fd417fe73ea971 Size: 4.09 MB (4093440 bytes) Detections: 3 Type: Executable File Path: %COMMONPROGRAMFILES%\Microsoft Shared\MSINFO Group: Malware file Last Updated: March 13, 2022
17.	C48EA.exe	5eb1d08fef7edf169d0953049be5e487	2
Name: C48EA.exe MD5: 5eb1d08fef7edf169d0953049be5e487 Size: 199.68 KB (199680 bytes) Detections: 2 Type: Executable File Path: %APPDATA%\6E521 Group: Malware file Last Updated: December 22, 2011
18.	3B5.exe	2e3bd2857c90c49f93a8771a443ddff0	2
Name: 3B5.exe MD5: 2e3bd2857c90c49f93a8771a443ddff0 Size: 316.92 KB (316928 bytes) Detections: 2 Type: Executable File Path: %APPDATA%\Microsoft\3886 Group: Malware file Last Updated: December 22, 2011
19.	msadrh10.exe	bcadb8f4552dc2e95ddca4d410cf9c3b	2
Name: msadrh10.exe MD5: bcadb8f4552dc2e95ddca4d410cf9c3b Size: 6.14 KB (6144 bytes) Detections: 2 Type: Executable File Path: %APPDATA%\Microsoft\Windows\Templates Group: Malware file Last Updated: October 9, 2012
20.	lsasrv.exe	0c7d566666a93993ae0023e90e21e394	2
Name: lsasrv.exe MD5: 0c7d566666a93993ae0023e90e21e394 Size: 840.07 KB (840076 bytes) Detections: 2 Type: Executable File Path: %TEMP% Group: Malware file Last Updated: October 12, 2012
21.	utilhlps.exe	1f3f77ae8e563bc17e394a3cdfaa193c	2
Name: utilhlps.exe MD5: 1f3f77ae8e563bc17e394a3cdfaa193c Size: 807.42 KB (807424 bytes) Detections: 2 Type: Executable File Path: %WINDIR%\system32 Group: Malware file Last Updated: May 13, 2013
22.	7F97BB.exe	fa80e60bf87e5db7d37160c034f8b92c	2
Name: 7F97BB.exe MD5: fa80e60bf87e5db7d37160c034f8b92c Size: 33.28 KB (33280 bytes) Detections: 2 Type: Executable File Path: %APPDATA%\7F97BB Group: Malware file Last Updated: January 31, 2013
23.	svchost.exe	c9401b099584715c646a20d344acd191	1
Name: svchost.exe MD5: c9401b099584715c646a20d344acd191 Size: 10.01 MB (10014720 bytes) Detections: 1 Type: Executable File Path: %WINDIR%\system32\Svchost Group: Malware file Last Updated: April 25, 2012
24.	rsmhsvcs32.exe	ef2c56e9457cfb8b414fc4a936cb96d6	1
Name: rsmhsvcs32.exe MD5: ef2c56e9457cfb8b414fc4a936cb96d6 Size: 1.79 MB (1791488 bytes) Detections: 1 Type: Executable File Path: %WINDIR%\system32 Group: Malware file Last Updated: June 11, 2012
25.	Diner Dash - Seasonal Snack Pack.exe	29712c2c2ca4842610fb3e7542a7045a	1
Name: Diner Dash - Seasonal Snack Pack.exe MD5: 29712c2c2ca4842610fb3e7542a7045a Size: 422.14 KB (422144 bytes) Detections: 1 Type: Executable File Path: %PROGRAMFILES%\Diner Dash Seasonal Snack Pack Group: Malware file Last Updated: June 26, 2012
26.	97DB.exe	f3c2510fb0c7e5b18a8dd1889ac27036	1
Name: 97DB.exe MD5: f3c2510fb0c7e5b18a8dd1889ac27036 Size: 89.1 KB (89107 bytes) Detections: 1 Type: Executable File Path: %APPDATA% Group: Malware file Last Updated: February 22, 2013
27.	3CB1.exe	92dab2a2176c898f9a6d93a561a3aff3	1
Name: 3CB1.exe MD5: 92dab2a2176c898f9a6d93a561a3aff3 Size: 233.47 KB (233472 bytes) Detections: 1 Type: Executable File Path: %APPDATA% Group: Malware file Last Updated: November 19, 2012
28.	fhx593hifrbi-10015.exe	ef42ee1245ac6403dce3aa5916b09891	1
Name: fhx593hifrbi-10015.exe MD5: ef42ee1245ac6403dce3aa5916b09891 Size: 199.68 KB (199680 bytes) Detections: 1 Type: Executable File Path: %SystemDrive%\Users\Emily.Emily-Win7 Group: Malware file Last Updated: March 29, 2013

More files

Analysis Report

General information

Family Name:	Trojan.Dropper.Agent
Signature status:	No Signature

Known Samples

MD5: adf30824b850dfbeb10031ef8fdcfba3

SHA1: 4cc3f6223df7d3249c436b953c8672bcc9ddcd35

SHA256: 000EAAC3D27EF569A685BAB9F28266AD011DC1DE15A6AD97134397B7BF3269CD

File Size: 462.85 KB, 462848 bytes

MD5: 9f126bc279a2253188a6875d2673b629

SHA1: 88438355b025cf3eba386e0362ddc3c8218ac6aa

SHA256: 774C986CEDB724CEC66CB87DE11079AD620E3492442FEC79B5926D1D47B1DFE3

File Size: 7.91 MB, 7914496 bytes

Windows Portable Executable Attributes

File doesn't have "Rich" header
File doesn't have debug information
File doesn't have exports table
File doesn't have relocations information
File doesn't have security information
File is 32-bit executable
File is 64-bit executable
File is either console or GUI application
File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
File is Native application (NOT .NET application)

File is not packed
IMAGE_FILE_DLL is not set inside PE header (Executable)
IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name	Value
Company Name	O2-Media.Inc
File Description	O2Jam NewLauncher
File Version	1.01
Internal Name	O2Jam NewLauncher
Legal Copyright	O2-Media.Inc All rights reserved.
Legal Trademarks	O2Jam
Original Filename	O2Jam.EXE
Private Build	GonaH
Product Name	O2Jam Launcher
Product Version	1.01

File Traits

golang
No Version Info
x64
x86

Block Information

Total Blocks:	15,108
Potentially Malicious Blocks:	8
Whitelisted Blocks:	14,751
Unknown Blocks:	349

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

... Data truncated

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

Agent.MPG
BruteForce.O
BruteForce.P
ShellcodeRunner.TVA
Spyloader.NG

Trojan.Downloader.Gen.RD

Files Modified

File	Attributes
c:\programdata\kalinkacrypt\encryptor_crash.log	Generic Write,Read Attributes

Registry Modifications

Key::Value	Data	API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe		RegNtPreCreateKey

Windows API Usage

Category	API
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAddAtomEx ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcConnectPort ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtAlpcSetInformation ntdll.dll!NtApphelpCacheControl ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtClearEvent ntdll.dll!NtClose Show More ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateIoCompletion ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtCreateTimer2 ntdll.dll!NtCreateWaitCompletionPacket ntdll.dll!NtCreateWorkerFactory ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateKey ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtNotifyChangeKey ntdll.dll!NtOpenEvent ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadToken ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDirectoryFileEx ntdll.dll!NtQueryFullAttributesFile ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadFile ntdll.dll!NtReadRequestData ntdll.dll!NtReadVirtualMemory ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimerEx ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTerminateProcess ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForMultipleObjects ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile ntdll.dll!NtWriteVirtualMemory ntdll.dll!NtYieldExecution UNKNOWN
Network Winsock2	WSAStartup
Process Shell Execute	CreateProcess ShellExecute WriteConsole
Process Manipulation Evasion	NtUnmapViewOfSection
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Process Terminate	TerminateProcess

Shell Command Execution


							C:\WINDOWS\system32\net.exe net session


							runas c:\users\user\downloads\88438355b025cf3eba386e0362ddc3c8218ac6aa_0007914496


							C:\WINDOWS\system32\runas.exe runas /user:Administrator "\"c:\users\user\downloads\88438355b025cf3eba386e0362ddc3c8218ac6aa_0007914496\" "


							WriteConsole: Attempting to st


							WriteConsole: RUNAS ERROR: Una

Trojan.Dropper.Agent

Threat Scorecard

EnigmaSoft Threat Scorecard

What is a Trojan-Dropper?

The Harmful Actions Trojan.Dropper.Agent can Perform When Inside a Computer

How Can I Get Infected with Trojan.Dropper.Agent

Is Trojan.Dropper.Agent Difficult to Remove?

Aliases

File System Details

Analysis Report

General information

Known Samples

Known Samples

Windows Portable Executable Attributes

Windows Portable Executable Attributes

File Icons

File Icons

Windows PE Version Information

Windows PE Version Information

File Traits

Block Information

Block Information

Visual Map

Similar Families

Similar Families

Files Modified

Files Modified

Registry Modifications

Registry Modifications

Windows API Usage

Windows API Usage

Shell Command Execution

Shell Command Execution

Submit Comment

Related Posts

Trending

Most Viewed