Trojan.Patcher.A

The detection of Trojan.Patcher.A on your system indicates a potential security threat that requires immediate attention. This type of malware is designed to compromise the security and integrity of your computer, and it's essential to understand its nature and take steps to remove it to prevent further damage.

What Is Trojan.Patcher.A?

Trojan.Patcher.A is a type of Trojan horse malware, which is a broad category of malicious software that disguises itself as legitimate or harmless. The name "Trojan.Patcher.A" suggests that it may be related to patching or modifying system files, but without more specific information, it's difficult to determine its exact purpose or behavior. Generally, Trojans are designed to allow unauthorized access to a computer system, steal sensitive information, or disrupt normal system operation.

How Trojan.Patcher.A Operates

Like other Trojans, Trojan.Patcher.A likely operates by exploiting vulnerabilities in software or tricking users into installing it. Once installed, it may communicate with its creators or other malicious servers to receive instructions or transmit stolen data. It could also modify system settings, install additional malware, or create backdoors for future access. The exact mechanisms of Trojan.Patcher.A are not specified, but its presence indicates a significant security risk that needs to be addressed.

Symptoms of Infection

Identifying a Trojan infection can be challenging because these malware types often hide their activities. However, some common symptoms may include unexpected changes in system behavior, such as slow performance, frequent crashes, or unfamiliar programs running in the background. You might also notice unusual network activity, changes in browser settings, or the appearance of unwanted toolbars or extensions. If you suspect that your system is infected, it's crucial to take action promptly to minimize potential damage.

How to Remove Trojan.Patcher.A

1. Boot your computer in Safe Mode with Networking to limit the malware's ability to interfere with the removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system. This can help identify and remove Trojan.Patcher.A and any other malware that may be present.
3. Uninstall any suspicious programs or applications that you do not recognize or that were installed around the time the malware was detected.
4. Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any malicious extensions or settings changes made by the Trojan.
5. Reboot your computer and perform another full scan with your anti-malware tool to ensure that the threat has been fully removed.

Conclusion

Removing Trojan.Patcher.A from your system requires careful steps to ensure that all components of the malware are eliminated. It's also a reminder of the importance of maintaining good cybersecurity practices, such as regularly updating software, using strong passwords, and being cautious when downloading or installing new applications. By taking proactive measures and staying informed, you can significantly reduce the risk of future malware infections and protect your digital security.

Analysis Report

General information

Family Name:	Trojan.Patcher.A
Packers:	UPX
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 1e02fa3f934fbcdfeab86eb880f7d5ea SHA1: 8ecaac6a037918b5d8722eab7e44c4af8ed6cac3 SHA256: F009874189618C227FC066532BFC37BCFA6F07CA8C0BB7C6353DD156DC952666 File Size: 199.17 KB, 199168 bytes

MD5: 4c80fc82ea590e935a9034f13b488c01 SHA1: 3c4ff39cf910cd4de5905af2e4c8367b7b33b8c7 SHA256: 813ACF2CBD3DCB7E8BF344E35A9556173077212E2C04AE6881C2C6E3490FFDC7 File Size: 559.10 KB, 559104 bytes

MD5: 09d5f2519ffa4cddee59a4027530811b SHA1: be9b12c67bbba1f279d5206d3b89917b7cd64af4 SHA256: 5E19EA36665DE7157E86237806011BCD39902152C3BC89942BA7A3259418BC20 File Size: 208.63 KB, 208626 bytes

MD5: 9db1a94b872ace78b39680ac68248f1b SHA1: 82c8a58b6f31dac2c515fea5002673066690b64f SHA256: 3EDAD1F2E16D29B5242BF3068BF99A93CBA691161E5530ECAAC8FE5C68D06634 File Size: 75.78 KB, 75776 bytes

MD5: 666e68025f8461de89c8ff534c299a83 SHA1: 05f9de3bad8dc85a16935018bc08c836ad81ce5e SHA256: CCE8007E0EF20CB89925E1B4BEC186C3A32598DD3952E22A53FCC11A9B52D9EF File Size: 199.68 KB, 199680 bytes

Show More

MD5: 5fadf7f209ca6b8d5f48f44632499fa5 SHA1: 06eb1147c360da16038913d6a41d0632833a0418 SHA256: 959F10F5F75D71204AE37F8C88A654AA5A5A3EF28D93138951428E6186A864C5 File Size: 43.52 KB, 43520 bytes

MD5: f13d6eef074deba9bbcae43bfe3deae9 SHA1: 42cb64633c5af4a25b31b69159e03ff0a4af7f5c SHA256: 57BBDFE3D9042FC2E449E989ADF52E7AF7595CA43A9817FE4AB7BB11A17221AA File Size: 62.98 KB, 62976 bytes

MD5: 7be418e29528db21fb103318a623defe SHA1: f9b839d7beaa9ce4c11793b96c3368424489a164 SHA256: 92A981EAF943F22AB731D099AA123CD1545D83E61161E7882A61809CA8D5E825 File Size: 461.42 KB, 461415 bytes

MD5: 3c5fcd6cee9170a077df23ddf5e76fa7 SHA1: b795240a5c15271961d0fee05a3adaecac3d5aaf SHA256: C3CD2304571EE282590B3BED7A331C8A972667CD3A816BCE60F9CC42D3944AC7 File Size: 80.90 KB, 80896 bytes

MD5: 4d3d87ac4e0bd8c30d3dcd462dba6e64 SHA1: 959e8f41b14a7d335563b289052d51c47bf00cba SHA256: 150AF1E131CFA9011F97A99D5C4FDE243A8B87586F4C5EE9686CF2D9269D075D File Size: 359.42 KB, 359424 bytes

MD5: a331bb8b1c5572470ce73bded66ae342 SHA1: 9d49b3cb5e1f5613bada132aa3096661c011d978 SHA256: C98D7C9A3F4A8C2497B5CE15D4A35B027C76C3A48C4CB6C301A3CD9AA4E5389B File Size: 3.09 MB, 3091968 bytes

MD5: 10846882f75bdce4084f5e46e869f2b0 SHA1: bf5afdc3ff4350de96e51e4f352d11fb18a90b15 SHA256: 5197EEFA8314744006A1F1A1E668F42C1C1FFE641327B4C34CF590857FD4BE6C File Size: 25.60 KB, 25600 bytes

MD5: 9c42779077795b3cdde0032c3ba4f3a6 SHA1: 8a2ecdb2408d0189127d7230c39f289f9219b193 SHA256: EBDDB92493A82015E231CE1A63C36CCF86B3C6E5E158AA3C82E2F577BE04134A File Size: 150.53 KB, 150528 bytes

MD5: 4e7f9209c6f0ec7ce1e384a7b95a74b8 SHA1: edbbc8fe62274d893431aedbc7c71862b99d1c34 SHA256: E99AA116BB577790D972A3D0B4E5B8348F3282D68F2E2847B6F2F985EA269E1D File Size: 202.24 KB, 202240 bytes

MD5: e020816dbd1438aa4b7a627dca7dbdea SHA1: fecf810ab1d27888eb8341d20aa748d54f815afe SHA256: 9B49E9B674EC5BF367B7AE3A7EF06C831174C7F4EA47C7C388B9E4004F5F1AD4 File Size: 155.65 KB, 155648 bytes

MD5: 247c95ff290ca9a0cdcf118a69663d98 SHA1: b55b79d990a17301040cb54c1c5f2570af7f4305 SHA256: 7A76BAA59614ACAF9F83F1A82C92987369FA3A4A732B5683BF7ACC1EB278CC4E File Size: 219.65 KB, 219648 bytes

MD5: b3d5c7cd03e190dbce2cfdaac545be15 SHA1: c4399b8404230359c098e9d77932978c0db05033 SHA256: DE8922FADD6A4594A01D6D09348E41699BE388FF6AC40870DBF25F110E77E536 File Size: 4.88 MB, 4880384 bytes

MD5: 9a7cb1da0c85652245492587035cbc48 SHA1: 0dd5376b318eab572e358ee8e0a3d446d017d2b8 SHA256: 4C585A3B2A3915F3E4FF8939BD503B05866AE282084DE91EFC78D4852F06C855 File Size: 3.01 MB, 3010187 bytes

MD5: 999c49c0dfb6b5491e9809f7477c31d9 SHA1: b20e363d8bf25c759e4ce6c2a756b93978ea04c1 SHA256: 9F94DC10D9D9132D719ECE4640BB62465C1F65685FA44A55CFFE81C79B75194E File Size: 41.98 KB, 41984 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has been packed
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application

Show More

• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	KelSat Presents
File Description	Ghostbusters V2.0.1.0 Plus 5 Trainer
File Version	1.00 1.0.1.32 1, 0, 0, 0
Internal Name	Ghostbusters V2.0.1.0 Plus 5 Trainer TJprojMain
Legal Copyright	KelSat Presents
Original Filename	TJprojMain.exe
Product Name	Ghostbusters V2.0.1.0 Plus 5 Trainer Project1
Product Version	1.00 1.0.0.0 1, 0, 0, 0

File Traits

• .adata
• .aspack
• .UPX
• 2+ executable sections
• ASPack v2.12
• HighEntropy
• No Version Info
• packed
• PECompact v2.20
• UPX!

Show More

• VirtualQueryEx
• WriteProcessMemory
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	27
Potentially Malicious Blocks:	19
Whitelisted Blocks:	7
Unknown Blocks:	1

Visual Map

0 x x x x x x x x x x x x 0 x x x x x x x 0 0 ? 0 0 0

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Banker.YA
• Downloader.Delf.F
• Injector.KAL
• Injector.KL
• Injector.N

Show More

• Patcher.A
• Remcos.W

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe	Generic Read,Write Attributes
\device\namedpipe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7za.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\a.7z	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\keygen.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\lanbo.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\lanbo.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nslbcbe.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nslbcbe.tmp\execdos.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nslbcbe.tmp\execdos.dll	Synchronize,Write Attributes

Show More

c:\windows\syswow64\brewers.dll

Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	꧲뫼華ǜ	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62*1\??\C:\P	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Other Suspicious	SetWindowsHookEx
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant Show More ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Process Terminate	TerminateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Kjttyhlk\AppData\Local\Temp\7za.exe" x "C:\Users\Kjttyhlk\AppData\Local\Temp\a.7z" -p5FD2ByXlbB -o"C:\Users\Kjttyhlk\AppData\Local\Temp\" -aoa

C:\Users\Kjttyhlk\AppData\Local\Temp\keygen.exe

C:\Users\Kjttyhlk\AppData\Local\Temp\lanbo.exe