Trojan.Ekstak.DD
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 5,018 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 13,508 |
| First Seen: | November 13, 2020 |
| Last Seen: | April 14, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Ekstak.DD |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
c1536a6e1cfed1875968593c05473dc7
SHA1:
653100541829bc0ba303a0b2050e7c0cbd3184d6
File Size:
3.81 MB, 3813180 bytes
|
|
MD5:
a0cd3e5f0bd8b11d2cbaa2bb8db51f01
SHA1:
f491773c5d56dd30141882786f5bff98dc70de0b
File Size:
2.71 MB, 2710341 bytes
|
|
MD5:
8ffcb4de23d3cb13669275b5b34d1d87
SHA1:
6ad211dd94165de75590bd78fc9c9b64c11b1251
SHA256:
D233E6DD1CCBA3D50B4E22AD8D080774B964260E3B46F3738717E50398233C92
File Size:
2.97 MB, 2968750 bytes
|
|
MD5:
f7b5f8414668d1aebe582faeff2e34c8
SHA1:
4b8cfe73d91b317b6dac75edd044176ef26c9ba0
SHA256:
9F2024C9EE893917D112DEB4E07761FC767833B90A36F64E316FF6102EB40664
File Size:
3.02 MB, 3018168 bytes
|
|
MD5:
3000441aa0eefdd893a491b44f377358
SHA1:
44cdd3196a1b12c080ac3729ef7d6114a8fd92df
SHA256:
6E7A63DCAE648CF9D162AF4442967905A5D8EE5397626B889B94A15225537C71
File Size:
3.23 MB, 3234266 bytes
|
Show More
|
MD5:
9be60b070f7ae4e20b7bc27a7e354069
SHA1:
1f4918d8d94fdcd1b9e993babeafe62c20f0b2e4
SHA256:
916623F5DA908ECC371977525019BAAA1EC6A78308DC05AB72B5ECC6543E3D8A
File Size:
2.98 MB, 2984337 bytes
|
|
MD5:
ee3438da761d2a432db27bb153bc70cc
SHA1:
b6af73e16f66efbd660da71afb63ce9b94bff0ac
SHA256:
4CCDE6964B332D0C8CB489D752513FA2EA12EB3F3E6227BC2515EF55F432CA9A
File Size:
3.48 MB, 3479884 bytes
|
|
MD5:
7b3fb1a30943e5407f4a7c96679a537d
SHA1:
fc820dddb3371c52850803b43c31deff0894e3bc
SHA256:
D381FB606DF9DBBF2E9069E12E28766B7E10F30E23D3F7ECB0232C6C587AE184
File Size:
3.39 MB, 3387510 bytes
|
|
MD5:
4542ea6d8b557466aa014b57521dce03
SHA1:
0f06a3d8a323ef011e686a12c93e076e9f2837e8
SHA256:
B1F7BB3DC1DEFC75BC390F024A86AE01E12CA513AACAD11B4342693E374B8446
File Size:
3.76 MB, 3759247 bytes
|
|
MD5:
d753d3c17540c54dd4e8e947b242063e
SHA1:
86efe87e056412cd38d4fc704e56e6f9da2c92bf
SHA256:
F9C2B4120D73447B76954782AF1C4D9B889EF2DAD3260610F8536BEC0C4D4A31
File Size:
3.48 MB, 3484287 bytes
|
|
MD5:
3cb2f859517025dccb6cab8af1789e8e
SHA1:
706c69f11369430759ab6d4f9ef57967a5ae70a5
SHA256:
436FCDAA0414B3D97FE0C2163F84D6D9D81FA9209B212B5CE29A6DC2A959481B
File Size:
4.93 MB, 4934656 bytes
|
|
MD5:
34a0bd5968f16a80d7929eb5fa9394b4
SHA1:
f80978aa14293085a6310e52cc220e2679c28828
SHA256:
29198419483AE2D07BEB44DCB7D29867A4BB4420F17A7615AAB342B07D2D992E
File Size:
3.10 MB, 3098471 bytes
|
|
MD5:
f548eaeae796133cf7f1a075b7a64173
SHA1:
eaa7260d32c38da06460fd80e09a15cdaa30f67d
SHA256:
FD1B4F0435B1FD7147084A526F23FF100E6B3A0714748FBB3CFC567E04DB5935
File Size:
2.98 MB, 2981168 bytes
|
|
MD5:
24b93407bccd30cdf162b7c8899ef8e0
SHA1:
ef2c607b34d074b64c82e41012a3710c6e3a1e98
SHA256:
9BCD6CEA6BD3B69DB0ED2FD9968FC9B8D2B5AED4FE7EF91545209600DBA1E422
File Size:
2.62 MB, 2622885 bytes
|
|
MD5:
497ea97b542439e33f68f9e2d2aed056
SHA1:
c210cbcdceebf12e8f4bcfa042f2fab2cb984995
SHA256:
B74D4C2761D94B24BF170FAC672F809B81111787233FD08314E01AA497ADFA45
File Size:
3.29 MB, 3286829 bytes
|
|
MD5:
06693df5d1876f49f30db70371e916d3
SHA1:
ae13356f06f50e76ccf3424c3e2e29684e180f4a
SHA256:
D61899B42F9F3CD403E63692203DAAD6065575342394ADADC51B9AB8A8776CCE
File Size:
4.23 MB, 4229097 bytes
|
|
MD5:
ee8a2d38c32206d39dff5fcbd521906a
SHA1:
ab47adcd9cb5ae63bae715863e1d50cb08445f8e
SHA256:
216702C3C19CE85014D84E0544742468979713000385C0913066C44F773C08C9
File Size:
5.44 MB, 5441536 bytes
|
|
MD5:
203b101f9aabdf8e24f25b5e50a0abd6
SHA1:
fcd651633065b94484ce9aab2fc143ecd617f2b5
SHA256:
2D6E7DF07272437E638070A3A45DD37A91E84DF4C969746AB84B94AD78A27BA8
File Size:
1.76 MB, 1759226 bytes
|
|
MD5:
e07a2e398795e98dbd37f46e98d8dde7
SHA1:
059d44579d8aebf0499489aba9bdd15b76bdcd6b
SHA256:
BBD33DBFAD45A2B8E39D22113F60D2AF3C6B0DAAFB3BC610DEE3FD0425E6A565
File Size:
2.81 MB, 2812476 bytes
|
|
MD5:
33ee1421b4aa37ecba38e1063859710d
SHA1:
ab7b709b631c6de9476438d2eb9c51f51a312431
SHA256:
A39B03701F49A0312558DABAA977F13DDB2D7AA05E7EBB28129521DFACB6B9C8
File Size:
2.57 MB, 2565120 bytes
|
|
MD5:
7662c4ec54a5b7d3047bf28d09e7a1ce
SHA1:
305fff54ec2e8b36d94893eae6913270dbb0b8fb
SHA256:
82249B241CB0408AF16F04B94E159B6DC81EC1362C63B0EA1A572476592B2009
File Size:
2.45 MB, 2445158 bytes
|
|
MD5:
6a6ecab486edad69c96ce939eb357e76
SHA1:
0e7781f7ef8ce1f1128c03a315a9a96770aa4269
SHA256:
D4A516ECA2A2389EDFF90A2192ACDBDC2AFDF8DDA49F8B81716A9AAE17686701
File Size:
2.12 MB, 2121501 bytes
|
|
MD5:
ede4d70085e742fe1fc1b3db8fc2150d
SHA1:
ba6ae34d4f5004cda8c2e434e9cb22472eb902b5
SHA256:
DEF53DA92042560072E00417DA03CA4346C17CE54EE3744E833737A3ADB98A88
File Size:
3.53 MB, 3532800 bytes
|
|
MD5:
97afdb3893d3fe2fc1df9bdc307da800
SHA1:
0b5e69cc3753514f80b435e702ee8b6aa5de5b32
SHA256:
11F491DFC2E0172838609D45E467E2E83203ADD3D7BA76B3D6E46C692DD3A89E
File Size:
3.54 MB, 3537836 bytes
|
|
MD5:
65e00600d5192d182c9736d416d242e3
SHA1:
45f2651a509e7b9f7889de74b95a4da983d8aaae
SHA256:
CCC0156944EF7F466C194D80CFED649C4370089EEEC0B980ACAB100818FD10BD
File Size:
2.97 MB, 2973184 bytes
|
|
MD5:
e1dacb429d4e32b35ae0b1da9ac1ecd7
SHA1:
c96f2de38888253f967d4d03ccad2531d401e68f
SHA256:
0EE348D07B1A9BF2927860AD6D28BF55368FB0AEF87C9F1B6D78D843FDE1DBC4
File Size:
2.41 MB, 2408152 bytes
|
|
MD5:
be3a700ce2e557f55c4f5c11e87e2b96
SHA1:
415c52880ec3147dad092dc03ba8244116bb4424
SHA256:
50D14831CE17519B922CD984ECA144F7CAD2DBC08B3E591B95E42C747A0DA445
File Size:
3.30 MB, 3303135 bytes
|
|
MD5:
5a0b7f332050b0a0320fda43e441541d
SHA1:
485e8ed1e0bae53afb2da20a0b3cacb3d24c9a1b
SHA256:
68BE8C77E88B22379831791CAAF8CF56954CBA850D38FAE7925E4A092D2AD653
File Size:
2.33 MB, 2325110 bytes
|
|
MD5:
c13fd3d7a062a9695a6138e88e761630
SHA1:
aab8358f05e0bd7c7b290736fea5276c5a7903ec
SHA256:
96219B64E97107EA45683BE3B5E5ACC8B12768D1684AFBEE377F204675FDB80E
File Size:
3.40 MB, 3398446 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
88 additional icons are not displayed above.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
|
| Legal Copyright | Parsian |
| Legal Trademarks | Parsian |
| Original Filename |
Show More
|
| Product Name |
|
| Product Version |
Show More
|
| Program I D | com.embarcadero.Parsian_Remote_Client |
File Traits
- 2+ executable sections
- Autoit
- HighEntropy
- imgui
- VirtualQueryEx
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 3,886 |
|---|---|
| Potentially Malicious Blocks: | 298 |
| Whitelisted Blocks: | 945 |
| Unknown Blocks: | 2,643 |
Visual Map
?
?
?
0
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
x
?
?
0
0
0
0
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
x
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
0
1
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
1
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
x
0
0
0
0
0
0
0
?
x
?
x
x
?
?
?
?
x
x
x
x
?
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
x
0
x
?
?
?
0
?
0
0
0
?
0
x
?
0
?
?
0
0
0
?
0
0
0
?
x
?
?
?
0
x
?
?
?
?
0
0
?
?
?
0
0
?
x
?
?
?
?
?
?
?
?
x
?
?
0
0
?
?
?
0
0
x
?
?
?
?
?
0
x
0
?
?
?
?
0
0
?
?
?
?
?
0
0
?
?
0
?
?
?
x
?
0
0
x
?
0
?
?
x
0
?
x
?
0
0
x
?
?
?
0
0
0
0
x
0
x
?
?
0
?
0
?
?
x
?
?
?
?
?
0
0
?
0
?
?
0
x
?
?
0
0
0
?
0
?
0
x
0
0
0
0
?
?
?
0
x
x
0
0
x
x
?
?
0
x
x
?
?
?
x
?
0
?
?
?
?
0
x
?
0
0
?
?
?
?
?
0
0
x
x
?
0
0
x
0
0
?
?
?
?
?
?
x
?
?
x
?
?
x
0
?
0
0
?
x
x
?
0
?
x
x
0
0
0
x
?
?
0
?
?
0
?
0
0
0
?
0
0
?
?
?
x
0
0
?
0
0
x
?
?
?
?
x
?
?
?
0
x
0
?
?
0
?
0
?
?
x
?
?
x
?
x
0
0
?
?
x
?
?
x
x
?
?
0
0
0
0
?
0
?
?
0
0
?
?
?
x
?
0
?
x
?
0
?
?
x
?
0
0
?
?
x
0
0
0
?
0
x
?
?
x
?
?
?
?
0
?
0
?
?
0
0
?
?
?
0
0
x
0
x
?
x
?
?
0
0
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
x
0
?
0
x
?
?
?
?
?
?
0
?
?
x
?
0
?
x
?
0
0
?
0
0
?
x
?
?
?
0
?
x
?
0
?
?
?
0
?
0
?
?
0
?
?
0
?
?
?
?
0
?
?
0
?
x
?
?
0
0
?
?
0
0
x
?
?
?
0
0
x
x
x
?
?
?
?
0
?
x
?
?
?
?
?
?
0
?
0
?
0
?
?
x
0
?
?
?
?
x
?
?
0
?
0
x
?
0
x
?
?
?
?
?
?
?
?
0
0
0
?
?
?
0
x
?
?
?
?
0
0
0
?
?
?
?
?
x
?
?
?
0
0
0
0
?
0
0
?
?
?
0
0
0
?
?
0
?
x
x
0
?
0
0
?
?
?
?
x
0
x
0
x
?
x
0
?
0
0
?
0
?
?
0
?
?
0
x
0
?
x
0
?
?
?
x
?
x
x
?
?
x
?
0
?
?
?
x
?
?
0
?
x
?
0
0
?
0
0
0
?
?
?
?
?
?
x
0
0
x
?
?
x
?
?
?
?
x
?
x
?
x
0
?
?
?
0
?
x
?
?
0
x
0
x
?
?
0
0
?
?
?
?
0
?
?
?
0
?
x
0
?
?
?
?
0
?
0
?
0
x
?
?
?
0
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
?
x
?
?
?
0
?
?
?
?
?
?
?
?
x
?
0
0
x
x
?
?
?
?
x
x
?
?
?
0
?
?
?
?
?
0
?
?
?
?
x
x
x
?
0
?
?
?
?
x
0
?
?
x
0
?
?
?
0
x
?
0
?
0
x
?
?
?
?
?
?
?
0
?
x
?
?
0
?
?
?
0
?
0
0
?
?
0
0
?
x
?
x
?
?
0
0
?
?
?
?
?
?
0
?
?
?
0
x
0
0
?
?
0
?
?
?
0
?
?
?
x
0
?
?
?
0
0
0
x
?
?
?
?
0
0
?
?
?
?
0
?
?
?
?
x
?
?
?
0
?
0
?
?
?
0
?
?
0
0
0
?
x
x
?
?
0
0
x
?
?
?
?
?
?
x
?
0
x
0
?
?
x
0
?
x
0
?
?
0
0
x
x
0
0
?
?
?
?
?
?
?
0
0
?
?
0
?
?
x
0
?
?
?
0
?
?
x
?
?
0
0
?
?
x
?
?
?
?
?
?
x
?
?
?
?
x
?
?
0
?
?
?
0
x
?
?
?
0
?
?
?
?
0
?
x
?
0
?
0
x
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
0
0
0
?
?
0
?
?
x
?
x
0
?
x
?
?
?
x
x
0
?
x
0
0
?
x
0
x
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
x
?
0
?
?
?
0
?
?
?
?
?
?
0
0
?
?
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
0
0
?
0
0
0
0
0
x
?
?
?
x
?
0
x
x
0
0
?
0
?
?
0
?
x
0
x
?
?
0
x
?
x
0
x
0
?
0
?
x
x
0
?
x
0
0
0
?
0
x
?
0
?
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- PersianRAT.A
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\downloads\runassystem.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 쾚촉僶ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Other Suspicious |
|
| Process Shell Execute |
|
| User Data Access |
|
| Syscall Use |
Show More
|
| Network Winsock2 |
|
| Network Winsock |
|
| Anti Debug |
|
| Process Terminate |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
open c:\users\user\downloads\\RunAsSystem.exe "c:\users\user\downloads\ab47adcd9cb5ae63bae715863e1d50cb08445f8e_0005441536"
|
