Trojan.ReverseShell.Gen.FY
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 4,256 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 87 |
| First Seen: | September 17, 2026 |
| Last Seen: | October 3, 2026 |
| OS(es) Affected: | Windows |
Trojan.ReverseShell.Gen.FY is a generic detection name used to identify a type of Trojan horse malware that gives attackers remote, unauthorized control over an infected computer. Because it is classified as a "Gen" (generic) detection, it may apply to a family of related threats that share similar behavior rather than a single, specific piece of malware. The name itself points to its core function: establishing a reverse shell connection that allows a remote attacker to issue commands to the victim's machine as though they were sitting at the keyboard themselves.
Table of Contents
What This Threat Does
Trojans in the ReverseShell category are designed to quietly open a communication channel from the infected computer back out to a server or system controlled by cybercriminals. Unlike a traditional remote access setup where a user connects outward on purpose, a reverse shell is initiated by the infected machine itself, which often helps it slip past firewalls and basic network security measures that are mainly configured to block incoming connections rather than outgoing ones.
Once this connection is established, an attacker can typically execute commands, browse files, install additional malicious software, exfiltrate sensitive data, or use the compromised machine as a stepping stone to attack other devices on the same network. Trojans of this nature are often built to run silently in the background, avoiding obvious signs of their presence so that the attacker can maintain long-term access.
How It Usually Gets Onto Computers
Like most Trojans, this threat generally does not spread on its own. It typically relies on tricking users into installing it. Common infection methods for this category of malware include malicious email attachments, deceptive links in phishing messages, bundled downloads from untrustworthy websites, cracked software, fake software updates, and exploit kits that take advantage of unpatched vulnerabilities. Once a user unknowingly executes the malicious file, the Trojan installs itself and begins establishing its remote connection.
Risks for the User
Because a reverse shell Trojan grants an attacker direct command-line style access to a system, the risks can be severe. Potential consequences include theft of personal or financial information, installation of additional malware such as ransomware or spyware, unauthorized monitoring of user activity, use of the computer in larger attack campaigns, and compromise of other devices connected to the same network. The longer such a Trojan remains active and undetected, the greater the potential damage.
Signs of Infection
Reverse shell Trojans are built to be stealthy, so obvious symptoms are not guaranteed. However, users may notice unusual network activity or unexpected outbound connections, a noticeable slowdown in system performance, unfamiliar processes running in task manager, security tools being disabled or malfunctioning, and strange files or programs appearing without explanation.
How to Stay Protected
Users can reduce their risk by avoiding downloads from unverified or suspicious sources, being cautious with email attachments and links from unknown senders, keeping operating systems and software fully updated to close security gaps, using strong and unique passwords, and maintaining regular backups of important files. Running reputable, up-to-date security software and performing routine system scans also helps detect and remove threats like Trojan.ReverseShell.Gen.FY before they can cause significant harm.
Analysis Report
General information
| Family Name: | Trojan.ReverseShell.Gen.FY |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
065f81a73a0c5eddf7f6d44e33ae0340
SHA1:
a212dff7effc70ad49cb95335b825456a756dd4a
SHA256:
7CD588850959546663C81077AF076835558C6A6AF33506A64A65784743DF92A1
File Size:
29.70 KB, 29696 bytes
|
|
MD5:
65d973bca10c9ce25d9baf846d272e38
SHA1:
866011ad5ee5e0126af0fb1b8b9e7c97dd6e3b2c
SHA256:
DE2099F488ACB59B21C120FA5F8A79B0D8856F6104B6F5165C25D6875D9BE1C3
File Size:
29.70 KB, 29696 bytes
|
|
MD5:
230a8d692f646e2b2ff69da8199fb355
SHA1:
3c95d9919fc1c81dbc63ad148db4f16815ee390b
SHA256:
C8E8224F252EB3D13632150D33D419992F54DCE3784573562AAE9E04D2797B09
File Size:
29.70 KB, 29696 bytes
|
|
MD5:
27ec1186870048275c9c3a810008d848
SHA1:
decb4b191826a9d5bae53204798d48d4c5537060
SHA256:
98A78C07CE1B032363BA2DCB9D0F5C9A1B53ECE3B85A2286851B8940F3926FBC
File Size:
75.41 KB, 75409 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | The Git Development Community |
| File Description | Git for Windows |
| File Version | 2.56.0.windows.1 |
| Internal Name | git |
| Original Filename | git.exe |
| Product Name | Git |
| Product Version | 2.56.0.windows.1 |
File Traits
- No Version Info
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 577 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 448 |
| Unknown Blocks: | 129 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
