Threat Database Trojans Trojan.MSIL.Agent.KS

Trojan.MSIL.Agent.KS

By CagedTech in Trojans

Threat Scorecard

Popularity Rank: 15,750
Threat Level: 80 % (High)
Infected Computers: 107
First Seen: February 5, 2024
Last Seen: February 25, 2026
OS(es) Affected: Windows

Analysis Report

General information

Family Name: Trojan.MSIL.Agent.KS
Signature status: No Signature

Known Samples

MD5: 1825a9ece42b3a38bce2bf17f40e05c2
SHA1: 81e3d8abdc3352b7899188c61b4d113f86bf746f
SHA256: 22EC63CB694CB33ED5E47D687F45AF519CBB935EEFE9E105F8A065C34A0BEA5D
File Size: 14.85 KB, 14848 bytes
MD5: 5776edefe429be49d0aba5803e1ebe1f
SHA1: 0ec5290753729cdcdebb28e4d65d9fe239311d28
SHA256: B319CCD22A32A6B16237FC949AE0C8E80EA1C44303804CA0B9FF7D105881BE93
File Size: 15.87 KB, 15872 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have security information
  • File is .NET application
  • File is 32-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Assembly Version 1.0.0.0
File Description
  • ActiveWindows
  • Maps
File Version 1.0.0.0
Internal Name
  • ActiveWindows.dll
  • Maps.dll
Legal Copyright Copyright © 2022
Original Filename
  • ActiveWindows.dll
  • Maps.dll
Product Name
  • ActiveWindows
  • Maps
Product Version 1.0.0.0

File Traits

  • .NET
  • dll
  • NewLateBinding
  • RijndaelManaged
  • x86

Block Information

Total Blocks: 35
Potentially Malicious Blocks: 11
Whitelisted Blocks: 21
Unknown Blocks: 3

Visual Map

0 0 0 0 0 0 0 0 0 0 0 x x x x 0 x x ? x ? x ? x 0 0 x x 0 0 0 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtFreeVirtualMemory
Show More
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWriteFile
  • UNKNOWN

Trending

Most Viewed

Loading...