Trojan.Keylogger.AG
The detection of Trojan.Keylogger.AG on your system indicates a potential security threat that requires immediate attention. This type of threat is designed to compromise your computer's security and potentially steal sensitive information. It is essential to understand the nature of this threat and take prompt action to remove it and prevent future infections.
Table of Contents
What Is Trojan.Keylogger.AG?
Trojan.Keylogger.AG is a type of malware that falls under the broader category of Trojans, which are malicious programs that disguise themselves as legitimate software. The "Keylogger" part of the name suggests that this particular threat may be designed to capture and record keystrokes, potentially allowing attackers to steal passwords, credit card numbers, and other sensitive information. Trojans like Trojan.Keylogger.AG can be distributed through various means, including infected software downloads, phishing emails, and exploited vulnerabilities in operating systems or applications.
How Trojan.Keylogger.AG Operates
Once installed on a victim's computer, Trojan.Keylogger.AG can operate in the background, hidden from the user's view. It may communicate with its command and control servers to receive updates or send stolen data. The keylogging functionality allows it to monitor and record keystrokes, which can be used to steal login credentials, financial information, or other sensitive data. Additionally, Trojans like Trojan.Keylogger.AG can also install additional malware, create backdoors for remote access, or disrupt system performance.
Symptoms of Infection
Identifying a Trojan.Keylogger.AG infection can be challenging, as it may not always exhibit obvious symptoms. However, some common signs of infection include slow system performance, unexpected pop-ups or ads, unfamiliar programs or toolbars, and unexplained changes to system settings. In some cases, victims may notice that their keyboard or mouse input is being recorded or that their login credentials are being stolen. If you suspect that your system is infected with Trojan.Keylogger.AG, it is crucial to take immediate action to remove the threat and prevent further damage.
How to Remove Trojan.Keylogger.AG
- Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for internet access. This will make it easier to download and install removal tools.
- Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove Trojan.Keylogger.AG and any related malware.
- Uninstall any suspicious programs or applications that may be related to the infection. Be cautious when removing programs, as some may be legitimate or required by your system.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons that may be associated with the infection.
- Reboot your computer and perform another full scan with your anti-malware tool to ensure that the threat has been completely removed. This step is crucial in verifying that your system is clean and secure.
Conclusion
Removing Trojan.Keylogger.AG from your system requires a combination of technical knowledge and caution. By following the steps outlined above and taking proactive measures to protect your system, you can reduce the risk of infection and prevent future attacks. Remember to always be vigilant when downloading software, opening email attachments, or clicking on links from unknown sources. Keeping your operating system, applications, and security software up to date is also essential in preventing exploits and protecting your sensitive information. If you are unsure about any aspect of the removal process, consider seeking guidance from a qualified IT professional or a reputable security expert.
Analysis Report
General information
| Family Name: | Trojan.Keylogger.AG |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
e516f64ca7c49773bc7ebfe065fb7f1d
SHA1:
5f4ccbef8db6d8e5db88bef42be51f20734bdb5b
File Size:
3.92 MB, 3922619 bytes
|
|
MD5:
c9e7f98686ce77f8765017b1767aacca
SHA1:
254b9f4420c0b6c0af9875114efff0b768326dcf
SHA256:
2DF23AF575EA3200660D5EA2F9BF60E027AD0D984494A84FD30464565AB59BB5
File Size:
7.82 MB, 7823932 bytes
|
|
MD5:
a7091ddc66e225acba7815a7827e944d
SHA1:
e49f77f933df26bc24a46e521266098f4a0f47a6
SHA256:
3752E9110869FAADB964117FFD4A9447FF5F9247905F2835AEFDC689D42CA7CE
File Size:
9.73 MB, 9726517 bytes
|
|
MD5:
f4f63ce885194cf59626d95a764d4ee3
SHA1:
0aa89cba5b9ff262927fa5f43e74a67f7177634d
SHA256:
8F5F839D8BBC78606112A62D04140133314CA48B6443EDFC453796184C9A59CC
File Size:
5.56 MB, 5564067 bytes
|
|
MD5:
b1b56cc14b35eca8022d38aadf3d9df5
SHA1:
400c00a4a5b0878d75f11162fe13a03f8bc785e3
SHA256:
9EC1B0CE00B1F4665F4ABA037621D17EABCE09242741298874A65491FE257912
File Size:
2.98 MB, 2982508 bytes
|
Show More
|
MD5:
1838a1e5b7b471477602e9c50a67cea9
SHA1:
952dc07a9dd8a11aec9437672593488b5ce4bdaf
SHA256:
688D02298DBE367C0C2EC68C271C4FB75B8F8C6F40830C9BCE7706DC80D06B5E
File Size:
2.63 MB, 2629812 bytes
|
|
MD5:
5cce34e128bcdcb913ede8771eddc1f7
SHA1:
8dfeb05276e4a19c538352b84beb89b053e14554
SHA256:
BE90BC76CA580BEAB52B87C32FAF13F674B15DB080AE23CEAC37A68288BFA278
File Size:
7.30 MB, 7297079 bytes
|
|
MD5:
7b736697bcaab99860514e7986e36c15
SHA1:
64cfce409ef3a6c21e3c81271b167f15e579d40e
SHA256:
C21D32A7B5E53DD680F6A9E3F5663D59D5A68021A8237D5A72D21F5F61D6137A
File Size:
8.42 MB, 8424743 bytes
|
|
MD5:
7837f09b2247fd0ca3fae30854c15411
SHA1:
cf72bf9ee89280e1d9af0de2b59793d9ee0c7c55
SHA256:
3FCCDE031A9BEE93CA02556DB931DE9CEF871953A8BA66A201BB7BA4EC38EDED
File Size:
3.94 MB, 3944983 bytes
|
|
MD5:
a52148b31195dc49d5c2ae2eb2b0e6fd
SHA1:
45e4748dd72ed1e0f433824a22e90cf627b201f9
SHA256:
17B4A2D2ED05CA64AFD8C9F77F305D6E591A712D3AA178C78FD1A98BED5C8686
File Size:
7.33 MB, 7332760 bytes
|
|
MD5:
072cf728cac5dc082945d337ec0542c1
SHA1:
3cda07379e94635f26c00ce88996d8cb2b795daa
SHA256:
D714F3E18ED1352FE5495419A708BDC398E22DA79B00899151A01140963BDCED
File Size:
2.56 MB, 2563228 bytes
|
|
MD5:
fe743c3b6efb065f3996df0606076c77
SHA1:
b51ad69906ff96c6861a286112406f240fb3b0ae
SHA256:
F3D695658B51FFDFB9EB2E7480422DA4576AC31ABD20CC334D98AC1BEED58428
File Size:
5.88 MB, 5881280 bytes
|
|
MD5:
f42afd0fb0843a009fa094ddd353e173
SHA1:
68b7ec4fcf1f92f52de1e3bde2a86db066ed53c9
SHA256:
3C26E50B4F677DFBD8BBE71E3CD1A546CCC7DB20C1A00911185F792A8F2FC8A9
File Size:
2.10 MB, 2097267 bytes
|
|
MD5:
c8ab6d1ccd587c130cd5e5d123510fc1
SHA1:
434b188cb593a7c203a11756f491dc9ca9d79019
SHA256:
254D01EBF90331DDBA2FED1A3C688450EA1A27EA24DA25227F8FFA5B6ABF55A7
File Size:
9.63 MB, 9631615 bytes
|
|
MD5:
0e61fdf7dc934f7ff41ac61a3b5040fe
SHA1:
3045927f10b8db9281a949445938022169a8d31a
SHA256:
DE4A038E749521335041289B9AC36C2AB481DB692A76BB2AE59E9DA04EEC13AF
File Size:
9.14 MB, 9141760 bytes
|
|
MD5:
526465f0dd67a51cb1b278411589eccb
SHA1:
51813acace9eac07851d2e5f7232b6e6cbbc47cf
SHA256:
75E3EF6E5C7B5806380EFC4621E2B0C70B7953125A8068DE84ABCB020C5A6007
File Size:
3.67 MB, 3671899 bytes
|
|
MD5:
ec2ce92ac6dc53c9d61885a1b1e1c79e
SHA1:
c2c1e7a417b224f6be6e60c6918bd35f6af691e5
SHA256:
F96E9928AAD0496CF3DCADC0206CEA1F022A75F6B3EA09E3C15AEB1512DDF850
File Size:
3.65 MB, 3648608 bytes
|
|
MD5:
e13e9af63c79750d5ad0ed0f92802751
SHA1:
0795bb614261f9a51046fc1030c554d1ea24a073
SHA256:
96E2390CCD066EAE2387C76F0BF2D029D6450113196A5D9D7841293765B81EE3
File Size:
4.99 MB, 4985762 bytes
|
|
MD5:
264e898e907a17990e07474bec4bcd96
SHA1:
7571aaf4cb556bfccf9130f8b5901f4d696c4c11
SHA256:
AE375EFD11CDC74391551D9B0D2FA81369083CBE1E4EB11156DF3B21DD4B5DF1
File Size:
5.61 MB, 5610472 bytes
|
|
MD5:
8f4ef53c9280be1f590450575afacec9
SHA1:
170478899576fe5897ae75ccbc733a8260b787b4
SHA256:
8D1E275B9B3FEB8CE58DFE5C78EDC30E806C84E72412902EDB4FD28BAAE8F707
File Size:
2.69 MB, 2690327 bytes
|
|
MD5:
532e29b5ef4e9fa243bfbd8da2554c28
SHA1:
8184cda330c15b86dd478d4d4375d3c44d8dd9fe
SHA256:
4FFF0DEA4BFEFC6BCD1623F594D7126B86D29DC3F72ACC50A0F5594A4B4C3BC1
File Size:
6.29 MB, 6290303 bytes
|
|
MD5:
32c17d4e90649aa6810b81f49eb951e8
SHA1:
2236504d5c2d10e523a26903ef0574f6e120887c
SHA256:
08EBA4910180C97BC2D6AC8F7E6863085EC6EEC61CA5D8D1E9B58F264C3A8EA4
File Size:
7.18 MB, 7178433 bytes
|
|
MD5:
a4ce87913a3f062dce617b931f24d789
SHA1:
9535c19c1625ab1f6522a0f47a87bf29aaf88396
SHA256:
E6D9FAEDADB829168746109570B72F9C00D54F28F314AF5CE88A555D14743F7A
File Size:
2.32 MB, 2316959 bytes
|
|
MD5:
052409b67c44a55f69cc95f1e07f547a
SHA1:
b527230ae5a784fcbe5b8e18e4eced1c0d155382
SHA256:
07610F131E9EE023F0945CE6780E84EA8C2E73BBB827E0761884F44072F0A958
File Size:
4.96 MB, 4958388 bytes
|
|
MD5:
1fa9434638f86409beeb5a16f2cf3931
SHA1:
392d7130cc10cce10b3df6a9cbecae27109e6c58
SHA256:
D78844B38B7B42FA1D24731A4F3A3C34ABE64D36586E3EFA1AA6637FDD5C7631
File Size:
6.13 MB, 6131195 bytes
|
|
MD5:
dd625465cea1df086c0bc442172e7697
SHA1:
f7c29de51d452da85bcd430fa95664481065005e
SHA256:
120F44585246C0E3872E17121358B8FCF32DB4C230FDF3633D71665A603D770F
File Size:
8.43 MB, 8432977 bytes
|
|
MD5:
607978b535030b68b6933dc13e551916
SHA1:
1f97ab45013fe22f068cb0a3cfc4af6a4fade972
SHA256:
2B2331365A0F5F9F66DBA10D88A653E219B5C24B6F398377D356C4E9FA770276
File Size:
2.10 MB, 2100381 bytes
|
|
MD5:
161ea24088ab4263910e05514f2d817a
SHA1:
bcfaf07b292357f69aefc772bacb9ac0cad01577
SHA256:
E4C3144D50FB2099A83682E4A6A55EB83314A9DF48AB19C956E92007DD1C1286
File Size:
6.82 MB, 6819233 bytes
|
|
MD5:
2fc4e3c40b6f920db9132806e9d8a5be
SHA1:
806d2c96d0cfa6f001d782fcedbbdc717de19b80
SHA256:
423679B63E39FDB2E8AB35914500E3196A94A0F1FD237B834A04CA261B93D62D
File Size:
6.31 MB, 6306059 bytes
|
|
MD5:
6b77670d7b4918c5648f5882df8a398d
SHA1:
c269921c5af25fa51910b033cf93569de69d6a7d
SHA256:
03795536C00DDCD07BE36EC25ACF67F8A08D404D778E02394DC9CE6FF3FE3FB9
File Size:
1.08 MB, 1083392 bytes
|
|
MD5:
c24c0d74c2bafcc51bf535b9401ff7e7
SHA1:
e3e9d2d99c53dc9ec52b68352ad2afbd5476c0d8
SHA256:
860073D976D05E7775CADF5A4B480157C970C6655D353AB6FE899BA372EDB270
File Size:
4.14 MB, 4137833 bytes
|
|
MD5:
58939002ff210c2a1a0e8d53b357bc01
SHA1:
80fbb41afdc17fc4001ce6541f647b40c9de957d
SHA256:
4E0B092BEB71EC252A4B315E48325950ADC20084E47303423C67BA89A7BA768E
File Size:
2.57 MB, 2573701 bytes
|
|
MD5:
728d441aa44eef0f2a18f1ca81d3f516
SHA1:
4cef86de5cce8555c568691500bb0afd0a66b599
SHA256:
E4397F471ACBFBB8692E0C09B50FDA6CFE628396377C6F62BC52C8D869935110
File Size:
8.33 MB, 8334891 bytes
|
|
MD5:
c2e66ad28544233b5a5579bb6c35a4b6
SHA1:
0d6869ef11571e1c7f121c1f864de509fa74ac51
SHA256:
3975ED5E8B5FCC26EA42209D0187052B15B235194CBFE20053659EC7A4F21FA4
File Size:
2.92 MB, 2922242 bytes
|
|
MD5:
64ad3531dab40a45c67503009bee90ab
SHA1:
2707350d852f55109f4b86d5ba6b90f4224e5d4d
SHA256:
DF17D261F5D41330679C99D4EE285D72889D57B362EBC3E04847262A51DF2EE5
File Size:
2.72 MB, 2716620 bytes
|
|
MD5:
2c275130de64d2499a98282054c42f3c
SHA1:
8e21155a5ff3a7876a26459dc1f4562b71f54ffe
SHA256:
E667FA415F74D330D43AA5B6A25A07238CF8515585D95A46B5D213B8F88F4EA8
File Size:
2.33 MB, 2327141 bytes
|
|
MD5:
ff94af8a0c3de4e0331d27a30795e3c1
SHA1:
c6082f5631a823a23fddd32a48cf15cc030cc43e
SHA256:
989F65F33CA8DA883DFB09AD7AE41FFB2E84CCD70B4DA6B02E1245E4A47697F1
File Size:
8.07 MB, 8073471 bytes
|
|
MD5:
64c6727f28f1fafb7bff42cfb0bb77d2
SHA1:
01654b7970a38e94136707411a5ad90ef95ad495
SHA256:
497686551B56DB666BDEDAE7C532AE8FA6C2574657F664754C665DC1014F6C23
File Size:
2.36 MB, 2359992 bytes
|
|
MD5:
8d96d2ae72db3f309d2cb479972a0e4b
SHA1:
1856f706610a4cc1ec40527efe90a99247952060
SHA256:
D4394902931B914567B1476D831E2500355051E0DA3C3DAF2BD5F076676A04CB
File Size:
4.66 MB, 4662039 bytes
|
|
MD5:
7d572e111607007f8e73a0ba9401318c
SHA1:
3b3812a24ea48bbdc625aff690f7c0c56e8f1bc5
SHA256:
39D402D25725FF08B8DF149F5D89D3B638BB69E903E91E9094CFE7435031DA0B
File Size:
4.54 MB, 4541791 bytes
|
|
MD5:
c787618a67c44e64bb91b2f3202f8556
SHA1:
98768dced9dbda44ea8ee31250806c32ecab3999
SHA256:
764E2B1FD4BDE9C3917CE266A9F02BA7F256428F438E1943650EEA1442A6BFE6
File Size:
1.56 MB, 1563220 bytes
|
|
MD5:
9046ece402533d16ef7097aad5b90fdd
SHA1:
c479d6fa090fa31b807e0d833e5f7f2ea91024ca
SHA256:
E2C97E94DBFB9283BADFD1F8C60573F7474D1B58EAC4505490CE074EE894D59A
File Size:
3.01 MB, 3006858 bytes
|
|
MD5:
12891fb4750652bc874a9722095761f9
SHA1:
8227262712578847ebb97bf71aedde6b334c538c
SHA256:
BC66CF867CC85EAF68C87742B1108094A25563958781EBB087A68FB1B999DD6B
File Size:
3.80 MB, 3802978 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
166 additional icons are not displayed above.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
|
| File Description |
|
| File Version |
Show More
|
| Internal Name | StdRt.exe |
| Legal Copyright |
Show More
|
| Original Filename | StdRt.exe |
File Traits
- big overlay
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 3,748 |
|---|---|
| Potentially Malicious Blocks: | 1,839 |
| Whitelisted Blocks: | 1,909 |
| Unknown Blocks: | 0 |
Visual Map
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
0
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
x
x
0
x
0
0
0
x
x
x
0
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
0
x
x
x
x
0
0
x
x
0
x
x
x
x
x
x
x
0
x
x
0
0
x
0
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
0
x
x
x
x
x
x
x
x
0
x
x
x
x
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
0
0
0
0
0
0
0
x
x
x
0
0
x
x
x
0
x
x
0
x
0
0
0
x
0
0
x
x
0
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
0
0
0
x
x
x
x
x
x
x
0
x
0
x
0
x
x
0
x
0
0
0
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
0
x
0
0
x
x
x
0
x
0
x
x
0
0
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
0
0
0
0
x
x
x
x
x
x
0
x
0
x
0
x
0
x
x
x
x
x
0
x
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
x
x
x
0
x
0
x
x
x
x
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
0
x
0
x
x
x
0
x
x
x
x
x
x
x
0
x
0
0
0
0
x
0
0
0
0
x
x
0
0
x
0
0
0
0
0
x
x
0
0
0
0
0
0
x
x
0
0
x
0
x
x
0
0
x
x
0
x
0
x
x
x
0
0
0
x
0
x
0
0
x
0
x
0
x
x
x
0
x
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
0
0
x
x
x
x
0
x
0
x
0
x
0
x
x
0
x
x
x
0
0
x
x
x
x
x
0
0
0
0
x
0
x
0
x
0
x
x
0
x
x
x
x
0
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
0
x
x
x
0
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
x
0
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
0
x
x
0
0
x
x
x
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
x
0
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
x
x
x
x
0
x
x
0
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
0
x
x
0
0
0
0
x
0
0
x
x
0
x
x
x
x
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
x
0
0
0
0
0
x
x
x
0
0
0
0
x
0
0
x
x
x
x
x
x
0
x
x
x
0
x
x
x
0
x
x
0
x
x
x
x
x
x
x
0
x
0
x
x
x
x
x
0
x
x
x
x
x
x
0
x
x
x
0
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
0
0
x
x
x
0
x
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
0
x
x
x
x
x
x
x
x
0
0
x
0
x
x
x
0
x
0
0
x
0
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
0
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
0
0
0
0
0
x
x
x
x
x
0
x
x
0
0
0
x
x
0
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
x
x
x
x
x
x
x
0
x
x
x
0
0
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
0
0
x
0
0
x
x
x
0
x
0
x
x
x
0
x
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
0
0
0
x
x
x
x
x
x
0
x
x
x
x
x
0
x
0
x
x
0
0
0
x
x
x
0
x
0
x
x
x
x
0
0
0
0
x
x
x
x
0
x
x
0
x
x
0
x
x
x
x
x
0
x
x
0
x
x
0
x
0
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
0
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
0
x
x
x
0
x
x
x
x
x
x
x
0
x
x
x
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
0
x
x
x
x
0
x
x
x
0
x
0
x
x
0
0
x
x
x
x
x
x
0
0
0
x
x
x
x
x
0
x
x
0
0
x
x
x
x
x
x
x
0
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
0
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
0
x
x
0
0
0
0
x
x
x
0
0
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
0
0
x
0
0
x
x
x
0
0
x
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
0
0
x
x
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
0
0
x
0
0
x
x
x
x
x
x
x
x
x
x
0
x
x
0
0
0
0
x
0
0
0
0
x
x
x
0
0
0
0
0
0
0
0
x
x
x
x
x
x
0
0
x
x
x
x
x
0
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
0
x
0
x
0
0
0
x
x
x
0
x
0
x
x
x
x
x
x
x
x
0
x
x
x
0
0
0
0
0
x
x
x
x
x
0
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
0
x
0
x
x
0
0
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Keylogger.AG
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\434b188cb593a7c203a11756f491dc9ca9d79019_0009631615_steam\steam_appid.txt | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\mrt2b7c.tmp\cctrans.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2b7c.tmp\kcini.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2b7c.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2b7c.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\aviflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\users\user\appdata\local\temp\mrt2d60.tmp\bmpflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\fliflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\gifflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\jpgflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\kcboxa.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\kcboxb.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\kccursor.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\kcplugin.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\kcwebx.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\pcxflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\pngflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\progressbar.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2d60.tmp\tgaflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2fd1.tmp\kcedit.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt2fd1.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt31f4.tmp\cctrans.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt31f4.tmp\kcclock.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt31f4.tmp\kccursor.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt31f4.tmp\kcini.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt31f4.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt31f4.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt31f4.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt31f4.tmp\mp3flt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt31f4.tmp\perspective.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt31f4.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt36e.tmp\54321.avi | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt36e.tmp\adshow.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt36e.tmp\kcwctrl.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt36e.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt36e.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt36e.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt36e.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt37c6.tmp\cctrans.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt37c6.tmp\kcini.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt37c6.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt37c6.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt37c6.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\aviflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\bmpflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\cctrans.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\fliflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\gifflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\jpgflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\kcpica.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\kcpict.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\mp3flt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\oggflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\pcxflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\pngflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt3f2d.tmp\tgaflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt419c.tmp\cctrans.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt419c.tmp\kcclock.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt419c.tmp\kccursor.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt419c.tmp\kcini.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt419c.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt419c.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt419c.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt419c.tmp\mp3flt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt419c.tmp\perspective.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt419c.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\aiffflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\clickteam-vector.mvx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\ctrlx.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\joystick.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\kcarray.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\kcini.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\kcwctrl.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\modflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\mp3flt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\oggflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\onu.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\onueng_mod.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\ultimatefullscreen.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4752.tmp\xboxgamepad.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt49b1.tmp\cctrans.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt49b1.tmp\kcini.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt49b1.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt49b1.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4ec2.tmp\adshow.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4ec2.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4ec2.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4ec2.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt4ec2.tmp\pcshutdownoperations.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt622e.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt622e.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt622e.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt622e.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt6694.tmp\mid0.mid | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt66b3.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt66b3.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt66b3.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt66b3.tmp\mmfs2.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt66b3.tmp\mp3flt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt66b3.tmp\stdrtd.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt66b3.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\box2dbase.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\box2dbase.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\box2dbouncingball.mvx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\box2dbouncingball.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\box2dspring.mvx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\box2dspring.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\clickteam-dragdrop.mvx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\clickteam-dragdrop.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\kclist.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\kclist.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\mmfs2.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\mp3flt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\stdrtd.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\steam_api.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt69a3.tmp\steamworks.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt6dfa.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt6dfa.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt6dfa.tmp\mp3flt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt6dfa.tmp\oggflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt6dfa.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt6e22.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt6e22.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt6e22.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt6e22.tmp\perspective.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt7003.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt7003.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt7003.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt7003.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt906a.tmp\cctrans.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt906a.tmp\kccursor.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt906a.tmp\kcfile.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt906a.tmp\kcini.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt906a.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt906a.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt906a.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt906a.tmp\mp3flt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt906a.tmp\oggflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt906a.tmp\perspective.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt906a.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt93fa.tmp\cctrans.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt93fa.tmp\kcini.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt93fa.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt93fa.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt93fa.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt93fa.tmp\perspective.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrt93fa.tmp\waveflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta66c.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta66c.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\aviflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\binary.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\bmpflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\dlgbox.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\dlgbox.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\fliflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\gifflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\jpgflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\kcbutton.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\kcbutton.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\kcfile.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\kcpica.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\kcpica.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\layer.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\mmfs2.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\mp3flt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\pcxflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\pngflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\stdrtd.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta7d3.tmp\tgaflt.ift | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta8fc.tmp\cctrans.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta8fc.tmp\mmf2d3d8.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta8fc.tmp\mmf2d3d9.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta8fc.tmp\mmfs2.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta8fc.tmp\mmfs2.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta8fc.tmp\oggflt.sft | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta8fc.tmp\stdrtd.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta9a8.tmp\advtray.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta9a8.tmp\audiere.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta9a8.tmp\blowfish.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta9a8.tmp\colordialog.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta9a8.tmp\ctrlx.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\mrta9a8.tmp\dlgbox.mfx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
252 additional files are not displayed above.
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\internet explorer\main\featurecontrol\feature_browser_emulation::8dfeb05276e4a19c538352b84beb89b053e14554_0007297079 | ⫹ | RegNtPreCreateKey |
| HKCU\software\microsoft\internet explorer\main\featurecontrol\feature_browser_emulation::8dfeb05276e4a19c538352b84beb89b053e14554_0007297079.vhost | ⫹ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.imaadpcm::fdwsupport | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.imaadpcm::cformattags | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.imaadpcm::aformattagcache | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.imaadpcm::cfiltertags | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msadpcm::fdwsupport | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msadpcm::cformattags | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msadpcm::aformattagcache | 2 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msadpcm::cfiltertags | RegNtPreCreateKey |
Show More
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msg711::fdwsupport | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msg711::cformattags | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msg711::aformattagcache | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msg711::cfiltertags | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msgsm610::fdwsupport | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msgsm610::cformattags | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msgsm610::aformattagcache | 1 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.msgsm610::cfiltertags | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.l3acm::fdwsupport | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.l3acm::cformattags | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.l3acm::aformattagcache | U | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\audiocompressionmanager\drivercache\msacm.l3acm::cfiltertags | RegNtPreCreateKey | |
| HKCU\software\microsoft\multimedia\msacm.imaadpcm::maxrtencodesetting | RegNtPreCreateKey | |
| HKCU\software\microsoft\multimedia\msacm.imaadpcm::maxrtdecodesetting | RegNtPreCreateKey | |
| HKCU\software\microsoft\multimedia\msacm.msgsm610::maxrtencodesetting | RegNtPreCreateKey | |
| HKCU\software\microsoft\multimedia\msacm.msgsm610::maxrtdecodesetting | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\mediaresources\directsound\speaker configuration::speaker configuration | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\direct3d\mostrecentapplication::name | bcfaf07b292357f69aefc772bacb9ac0cad01577_0006819233 | RegNtPreCreateKey |
| HKCU\system\currentcontrolset\control\mediaproperties\privateproperties\directinput\vid_0627&pid_0001\calibration\0::guid | 쯰恮⨠ᇱƀ䕄呓 | RegNtPreCreateKey |
| HKCU\software\microsoft\directinput\mostrecentapplication::version | Ԋ | RegNtPreCreateKey |
| HKCU\software\microsoft\directinput\mostrecentapplication::name | E3E9D2D99C53DC9EC52B68352AD2AFBD5476C0D8_0004137833 | RegNtPreCreateKey |
| HKCU\software\microsoft\directinput\mostrecentapplication::id | E3E9D2D99C53DC9EC52B68352AD2AFBD5476C0D8_00041378335562D670003F2369 | RegNtPreCreateKey |
| HKCU\software\microsoft\directinput\mostrecentapplication::mostrecentstart | 㓍켨빧ǜ | RegNtPreCreateKey |
| HKCU\system\currentcontrolset\control\mediaproperties\privateproperties\directinput\vid_0627&pid_0001\calibration\0::guid | 豠ᵦㆄᇱƀ䕄呓 | RegNtPreCreateKey |
| HKCU\software\microsoft\directinput\mostrecentapplication::name | 0D6869EF11571E1C7F121C1F864DE509FA74AC51_0002922242 | RegNtPreCreateKey |
| HKCU\software\microsoft\directinput\mostrecentapplication::id | 0D6869EF11571E1C7F121C1F864DE509FA74AC51_00029222425562D670002C9702 | RegNtPreCreateKey |
| HKCU\software\microsoft\directinput\mostrecentapplication::mostrecentstart | 殰谝엋ǜ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\direct3d\mostrecentapplication::name | 2707350d852f55109f4b86d5ba6b90f4224e5d4d_0002716620 | RegNtPreCreateKey |
| HKCU\software\microsoft\ctf\msutb::left | ঔ | RegNtPreCreateKey |
| HKCU\software\microsoft\ctf\msutb::top | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | n � 8�tX�jg�8 �� �v �Z xy �� �� T�������dc�%�� �5��3bBx �< �� #��$kF%�&� &�-(�(X�(�)E)�`*J*9*�"-!R0P%1`1�1HO 5,]=� @V� A��B�� G�IH[uH�pI��J�� K��N$N� U_*X�Z^� \te | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | n � 8�tX�jg�8 �� �v �Z xy �� �� T�������dc�%�� �5��3bBx �< �� #��$kF%�&� &�-(�(X�(�)E)�`*J*9*�"-!R0P%1`1�1HO 5,]=� @V� A��B�� G�IH[uH�pI��J�� K��N$N� U_*X�Z^� \te | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �m y 8�� �� �v xy �� �� T�����dc�%�� ��Bx �< �� $kF%�&� &�-(�(X�(�)�`*9*�"0P%1�1HO 5,]=� @V� A��B�� H[uJ�� N$N� U_*X�.X�\te_�za$b"hc�w i��j�bk�ql(�rnJ tǤu�~ v�!w�ny�9 {b�|ۘ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �m z 8�� �� �v xy �� �� T�����dc�%�� ��Bx �< �� $kF%�&� &�-(�(X�(�)�`*9*�"0P%1�1HO 5,]=� @V� A��B�� H[uJ�� N$N� U_*X�.X�\te_�za$b"hc�w e�vi��j�bk�ql(�rnJ tǤu�~ v�!w�ny�9 {b� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �m { 8�� �� �v xy �� �� T�����dc�%�� ��Bx �< �� $kF%�&� &�-(�(X�(�)�`*9*�",=� 0P%1�1HO 5,]=� @V� A��B�� H[uJ�� N$N� U_*X�.X�\te_�za$b"hc�w e�vi��j�bk�ql(�rnJ tǤu�~ v�!w�ny�9 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | n � 8�tX�jg�8 �� �v �Z xy �� �� T�������dc�%�� �5����3bBx �< �� #�#��$kF%�&� &�-(�(X�(�)E)�`*J*9*�"+�[-!R0P%1`1�1HO 1�D5,]9ߔ=� @V� A��B�� G�IH[uH�pI��J�� K��N$ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | n � 8�tX�jg�8 �� �v �Z xy �� �� T�������dc�%�� �5����3bBx �< �� #�#��$kF%�&� &�-(�(X�(�)E)�`*J*9*�"+�[-!R0P%1`1�1HO 1�D5,]9ߔ=� @V� A��B�� G�IH[uH�pI��J�� K��N$ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | (m � 8�1tXjg�8 �� �6 �v �Z �� �� T������ 1��dc�%�� 3bBx �� �R �7#��$kF%`� %�&� &�-'�(�(X�(�)A)�`*J*9*�"+��-!R0P%1`1�1HO 5,]=� @V� A��B�� G�IH[uH�pH�� I��K��N$N� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | )m � 8�1tXjg�8 �� �6 �v �Z �� �� T������ 1��dc�%�� 3bBx �� �R �7#��$kF%`� %�&� &�-'�(�(X�(�)A)�`*J*9*�"+��-!R0P%1`1�1HO 5,]=� @V� A��B�� G�IH[uH�pH�� I��K��N$N� | RegNtPreCreateKey |
| HKCU\software\microsoft\ctf\msutb::left | Դ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
| Other Suspicious |
|
| Keyboard Access |
|
| Network Wininet |
|
| Network Winsock2 |
|
| Network Winsock |
|
