Worm.Agent
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 90 % (High) |
| Infected Computers: | 73 |
| First Seen: | July 24, 2009 |
| Last Seen: | March 2, 2021 |
| OS(es) Affected: | Windows |
The detection of Worm.Agent on your system indicates a potential threat to your computer's security and integrity. It is essential to understand the nature of this threat and take immediate action to remove it and prevent future infections.
Table of Contents
What Is Worm.Agent?
Worm.Agent is a type of malware that can spread from system to system without the need for human interaction. It is a self-replicating program that can cause significant harm to your computer and data. Worms like Worm.Agent can be designed to steal sensitive information, disrupt system operations, or create backdoors for remote access.
How Worm.Agent Operates
Worm.Agent operates by exploiting vulnerabilities in software or using social engineering tactics to infect systems. Once inside, it can propagate itself to other systems through network connections, email, or infected software downloads. Worms can also modify system settings, create new files or folders, and interact with other malware to achieve their malicious goals.
Symptoms of Infection
Systems infected with Worm.Agent may exhibit a range of symptoms, including slow performance, frequent crashes, or unexplained changes to system settings. You may also notice unusual network activity, unfamiliar programs or files, or pop-ups and alerts from your security software. In some cases, the infection may not produce any noticeable symptoms, making it essential to rely on regular security scans and updates to detect and remove threats like Worm.Agent.
- Unexplained changes to system settings or files
- Slow system performance or frequent crashes
- Unusual network activity or unfamiliar programs
- Pop-ups and alerts from security software
How to Remove Worm.Agent
- Boot your system in Safe Mode with Networking to prevent the worm from spreading or interfering with the removal process.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect all instances of Worm.Agent.
- Uninstall any suspicious programs or applications that may be related to the infection.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
- Reboot your system and perform another full scan to ensure that all remnants of Worm.Agent have been removed.
Conclusion
Removing Worm.Agent from your system requires a combination of technical expertise and caution. By following the steps outlined above and maintaining good security practices, such as regularly updating your software and being cautious when opening email attachments or downloading files, you can reduce the risk of infection and protect your system from future threats. Remember to always use reputable security software and stay informed about the latest malware threats to ensure the integrity and security of your computer and data.
Aliases
15 security vendors flagged this file as malicious.
| Antivirus Vendor | Detection |
|---|---|
| Panda | Trj/Genetic.gen |
| AVG | Dialer.11.BA |
| Fortinet | Riskware/211 |
| AhnLab-V3 | Unwanted/Win32.Dialer |
| Microsoft | Tool:Win32/PornDialer.HJ |
| Antiy-AVL | Porn-Dialer/Win32.Juicy.gen |
| AntiVir | DIAL/Dialer.Gen |
| Comodo | ApplicUnwnt.Win32.PornDialer.GBDialer.A |
| Sophos | Dial/GBDial-A |
| Kaspersky | not-a-virus:Porn-Dialer.Win32.Juicy |
| Avast | Win32:PornDialer-CX [Dialer] |
| Symantec | Dialer.GBDial |
| McAfee | Artemis!DD402666999C |
| Panda | Dialer.Gen |
| AVG | Dialer.VKG |
File System Details
Worm.Agent may create the following file(s):
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | magent.exe | eba004d51d4ae64b8bb968b3f46d1c64 | 21 |
| 2. | mexica.exe | 1450e035430c67e009c52d8c84bf082f | 3 |
| 3. | wzrdsyssetup.exe | 015cb1433ad5d4f7cfb72fefba6cc36b | 0 |
| 4. | soundmsg.exe | 23c1fc48f516a036216ec90a17673cd0 | 0 |
| 5. | wawjerbt.exe | ac3a4b4ec2c8fc4d7d79ded75db3b865 | 0 |
| 6. | lsass.exe | 4eddd297eece9f71ed438c936e0d5320 | 0 |
Analysis Report
General information
| Family Name: | Trojan.Agent |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
034aeffe6d1b99d85c2471c1301ccc10
SHA1:
689ef15be29438e2b5c952e38006691e6df182ed
File Size:
3.17 MB, 3172985 bytes
|
|
MD5:
39105f8ac510efe7f5b7d6c67c2db0a7
SHA1:
52069a6f0f66c7f9192cba27899c728883f61eb7
File Size:
315.39 KB, 315392 bytes
|
|
MD5:
a1bebca8b9618045a83ebf5f0dd25894
SHA1:
0bfd269195cbec4af7144009464410af04012bdf
File Size:
152.06 KB, 152064 bytes
|
|
MD5:
4e8bd96f56a7edc8e6e797ff1b2a8849
SHA1:
345bcf3ab1f384717a8829d07bfd45e96ba6c0c6
File Size:
712.70 KB, 712704 bytes
|
|
MD5:
79187c801cfeae8695908bda908ec6d2
SHA1:
4886e42d78068fdf0c81beffe41de0374d6cfee4
File Size:
3.17 MB, 3172985 bytes
|
Show More
|
MD5:
10eb5e49706f22a8deace0a2dbdc82c6
SHA1:
5b2f524fc0d7fe4fa7bf9d389ff2a8a6af51ac36
SHA256:
836AF134423747FED3A54E2F258D3C5165DDB010AEBE2DC88839988D1A733217
File Size:
259.07 KB, 259072 bytes
|
|
MD5:
982e02da0d1b4c14cf6514dfd6d8946c
SHA1:
79e005d1c8d12265766d41f989ad1c6b0175d3d1
SHA256:
51253A229E97D2BC8928021B690E5657937793E5A268B76CCA48E0AF7A0B4051
File Size:
4.32 MB, 4315648 bytes
|
|
MD5:
3fdd34dc0177d250c16ed3efdc807f0a
SHA1:
f03ba3bc296375d6a7bf07fbdf37437d1bfa2e22
SHA256:
A42F8140A82D6741B3A3D15A6215853AFA94E8FE8EEA27F7A134B0D00B934B5F
File Size:
5.46 MB, 5456384 bytes
|
|
MD5:
df2e6b2e6960520c0f482741c79dc24a
SHA1:
cb26843852dda20f03ab4998b6683f55ae2d3608
SHA256:
40AFEC8B1433B13EF1EF83579EAA332FAD5E1374319A68AF6DF7701E35397CBE
File Size:
5.43 MB, 5430784 bytes
|
|
MD5:
e215575c3fee36bb0121f4db50257d7a
SHA1:
4423aacfad4fc1118c12cd66bf68aa4f236aa8a8
SHA256:
65E05A9375A7B380FB7D5015B473644EC879F418CAADE97F1808CBE6070D8EC6
File Size:
7.26 MB, 7264256 bytes
|
|
MD5:
400bd063c90795b3c746f56b20811552
SHA1:
1cf446bc8a5c1e1d06faeaedb7fe60f979ef8601
SHA256:
FE45293CD5AE73720D20505E1706FF1E3A76A698CF9B5CC7F5319F27D888493A
File Size:
1.78 MB, 1782504 bytes
|
|
MD5:
91dfe7793d1ea3dea55f08435c4ea846
SHA1:
5bdb172a4954382270f8f028d02ce99e9f12c833
SHA256:
76320C125F0750F787868F351897BCE1F753FE7270D5361843CADCCD8419D71B
File Size:
84.48 KB, 84480 bytes
|
|
MD5:
80fbe78de0b2daca2c7d7713042c0647
SHA1:
0a28918f32111ab71bb3f37388d407056a54e6c7
SHA256:
DEA17A69E716E42799EC824BD42D3C3438B76799792DD7AF92B82A10CD0BA972
File Size:
316.93 KB, 316928 bytes
|
|
MD5:
5ad3e10228e5e93cd23570ec095af782
SHA1:
36b07cc3f35c7250bfe20502a5825c16f399d30f
SHA256:
10CB893D05979F366FF7B5AB24D5882DD80998E1DA41226D1E171D4063935160
File Size:
9.64 MB, 9639936 bytes
|
|
MD5:
ec3812058142c9ed90d7d86210d3a23d
SHA1:
61b90de3b1ecf016970ff127447087e7d6f10883
SHA256:
F117BB2021A0D1B09ADB5CCA0788B41E5AFD9363B6A68255290721B89A862FA0
File Size:
3.56 MB, 3555840 bytes
|
|
MD5:
122b4555cb9cf6917f1878f66be1bd1c
SHA1:
8eaa3067768715e232067198fd96678f3641f476
SHA256:
83B17F02ED2989FD12F444F530903B12453BC39AB2056EFA501F1A6A21FC5ACE
File Size:
2.66 MB, 2657792 bytes
|
|
MD5:
5292c9e907ceb342aaefc84cea79bc17
SHA1:
f37cedcb79a96452eefa5f1f4d147f1175c848de
SHA256:
DBA129AFAFB0DC6FDBB679ACDDEA6913F6C634382181D492BB935A20FE41F0C8
File Size:
7.09 MB, 7089664 bytes
|
|
MD5:
540b2fe3233595acbb78b3727c44060c
SHA1:
cd526ab1a8cac6534a246050d8dd777b01a88e44
SHA256:
C485B5579657FF04723C13B5FEC610C64B232A0BEA58CCBF762235FE92104B6D
File Size:
6.16 MB, 6159650 bytes
|
|
MD5:
aa63d45a59a56b52de7800435fdcd7c3
SHA1:
0f267739f02e29f12b1c4330cc8aebc229c8ed7c
SHA256:
2E74DD8170DA84126E8DFE0518DBF93BF885B749FCBBD4B082708C00CA6451C2
File Size:
5.81 MB, 5805056 bytes
|
|
MD5:
9feaebe9322d145f48db773922e1f13a
SHA1:
1d430da4ec12e9ca600297bcf96ae8ed83a6db63
SHA256:
530C43415B1051D4F78F42A78794D77CD1CF1396241C4483AA9F76A103E94121
File Size:
592.84 KB, 592840 bytes
|
|
MD5:
0fac71281a99eac04ff5a194e5eaa3bb
SHA1:
8bb11de30d5554f97cdb4b933eb0d9ddba01babf
SHA256:
0280C4EEBA7439BDCF880F013F7FE997CFAB2F0FC88D2C53BAE5DE097268ACF9
File Size:
3.17 MB, 3172985 bytes
|
|
MD5:
2a95bf1e1419bd4919291d32f7b4739e
SHA1:
25c7f86f6493491525428562b67480cb10ec6dbc
SHA256:
0BE31AAB41FB1740B176811377EEB2E59809C7A1D332F7F4C465BF7E9DAF406A
File Size:
9.28 MB, 9280512 bytes
|
|
MD5:
308c0dbf3bd27e1c9921c8d96811254b
SHA1:
db536bf9ce28cb79c9635bd0e6e5cf1ac893a4b7
SHA256:
B77B70F40D79362E0BE63822F3E7CFE36C645F884F0BB3A9FD4DB3BB2814D63F
File Size:
9.29 MB, 9293824 bytes
|
|
MD5:
663b423b5a1c8a4c4150a74c9676b486
SHA1:
430054e3e36424ea887a1d8af132f13d8e47c691
SHA256:
FE854FFDE15094F31E014EC3EB93927D225D20A883D7904B02EDB2F4715BFC63
File Size:
1.08 MB, 1075712 bytes
|
|
MD5:
77ee84119fef893309aef2f157d9789c
SHA1:
72223e8d13eb9454937b92c7278c4d24baf34265
SHA256:
A403109D774D94558BB54E75E17AA1597508C4AB79146959EDF772DEC6E9AAA8
File Size:
2.07 MB, 2068817 bytes
|
|
MD5:
2332a0042ad102248c279188ebd1d3e8
SHA1:
5f377fc164f033f1473b722f105a368f65aa1572
SHA256:
393DA7D18014A72BB26910EE6405496791B3120FB59938BE4AE6A99F039583AF
File Size:
5.57 MB, 5565952 bytes
|
|
MD5:
caa990217afc5d7209fe3b38f0d42ca2
SHA1:
5518a09e6a9f5cd8005142191115bf3ae6747d52
SHA256:
94A6858FDA6E05E14155C2B853044EACD4CF486535834241123815975879459E
File Size:
1.96 MB, 1964032 bytes
|
|
MD5:
d97fb3328da5d17b296eb97aff2362a0
SHA1:
9bca9d54cd4a898c044a8c8731ac5ea2bef7365c
SHA256:
7C907DE722EC80907F26E22DFA0FC8CDEDA170C4B557CA1BB08AF6DCF738FB96
File Size:
7.82 MB, 7818752 bytes
|
|
MD5:
7b75ea7c531de6bc03d5d3bf3fe0f642
SHA1:
1cae07ea99257f3edbf935304e5cdc63984e46ab
SHA256:
B5AF600B17AB0F7DA70C66AF23826148F492C2924DCA8C315E4061B24C3814C7
File Size:
712.70 KB, 712704 bytes
|
|
MD5:
5539700044d73d758b2790731a361011
SHA1:
463485d14d82df8664d55aa65ab5b1e58fb1a931
SHA256:
0D4C616164261951F4BEA7943B240E4792FB33CF6F66AF8DD5062E049031B0E4
File Size:
6.43 MB, 6429696 bytes
|
|
MD5:
7d783e72e6b1c0d095f9cde44ee8002c
SHA1:
55a2df488e963ef4fc44daaf230e4a3bccf29528
SHA256:
4EE2320E251A2C48ADA001322B6DC8C924004323A040EE060EC8CBA9F2FCEEA4
File Size:
3.92 MB, 3917384 bytes
|
|
MD5:
06a8f7f3a5ced9f1e9095c25d8ca757f
SHA1:
d3132fc8ea2663f7539f7eca19bad67ec9035e91
SHA256:
BC203B835D98AC8890649B3FDC1503AD0905DEF57B851741AA998D0ED006990B
File Size:
2.76 MB, 2763496 bytes
|
|
MD5:
f0256a67a8fecb3e3f7dcceefb5e43f4
SHA1:
428f15c87112e5d349777a9227bdcda2bf218fe5
SHA256:
1CD20DF6AD735833F04EE6A64628A44FCFB990BA7C1DE5D0686AABC4EA2028DD
File Size:
1.64 MB, 1638400 bytes
|
|
MD5:
1c06f9738ccd1c407b9f7e19ccaa7329
SHA1:
4391b40a52b8d9625888b7bbf429adae1f63049a
SHA256:
9EDB6AFBEDECFFEB9562D7AF2B7A4B8239EF0EA14B737CF03D636457B225C04F
File Size:
2.08 MB, 2083550 bytes
|
|
MD5:
d032fd18766724925045c9ffff8b78ab
SHA1:
358506c4591367cb73cf9b46c5c86efbddad651f
SHA256:
55B24D4B5FF15C5AF343C9F594D2E3F735449F79A67998871EC9E32D066CCD9E
File Size:
86.53 KB, 86528 bytes
|
|
MD5:
198f281a170821d2130f842b838f67c8
SHA1:
05fa0f4219357b76caab45e70ccbda572bbdaaf1
SHA256:
6EDCCA26A1A7C993CF8E52C68236883889E2975A5D6A39FC126ACB1A18788903
File Size:
8.21 MB, 8205312 bytes
|
|
MD5:
04e29beae4aa446cb48f0f3c9fd50c3b
SHA1:
872829ffb289be30fca493a1f6d68a732493d243
SHA256:
734EF7461DBB621CF6D9BE8EB97B91B2C00C35856C9FA29F79E2A10DEF4DD8A6
File Size:
475.21 KB, 475213 bytes
|
|
MD5:
808f319f750c358faaad8af4e83f0a78
SHA1:
2e0f52cfe5a1bc6ed39e1799af07b678c5c644b1
SHA256:
76C87C6C607231C4FA3CB59EA7C081743B90060821EF3DBC5725E368CF01A470
File Size:
1.33 MB, 1331712 bytes
|
|
MD5:
5b25fb917a57a100bde2ee6a4ae8ac84
SHA1:
9c858abbbcc9b562a75f72a8cb5695d625299785
SHA256:
BC37709F20CA4BFDF4C1DD959F899EECEE1C9AE6B6B3878CFE4389A6B91ACB82
File Size:
908.80 KB, 908800 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
Show More
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments |
|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Legal Trademarks |
|
| Original Filename |
Show More
|
| Private Build | 01.00.00.00 |
| Product Name |
Show More
|
| Product Version |
Show More
|
| Version | 1.11W |
| W D Version | 27.0 |
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| KOSCOM CORP. | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Self Signed |
File Traits
- .NET
- 00 section
- 2+ executable sections
- Agile.net
- Autoit
- big overlay
- CAB (In Overlay)
- Confuser
- Fody
- GenKrypt
Show More
- HighEntropy
- Inno
- InnoSetup Installer
- Installer Manifest
- Installer Version
- NewLateBinding
- No Version Info
- ntdll
- Reactor
- Reflective
- RijndaelManaged
- vb6
- VirtualQueryEx
- Wix
- WixToolset Installer
- WriteProcessMemory
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,035 |
|---|---|
| Potentially Malicious Blocks: | 80 |
| Whitelisted Blocks: | 597 |
| Unknown Blocks: | 358 |
Visual Map
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
x
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
?
x
?
?
?
?
?
0
?
0
?
?
?
?
?
0
?
0
x
0
x
0
x
0
0
x
0
?
0
x
0
x
0
x
0
x
0
x
0
x
0
x
0
x
0
x
0
x
0
x
0
0
0
0
0
0
0
0
0
?
?
?
?
0
?
0
?
0
x
0
x
0
x
0
x
0
x
0
x
0
x
0
x
0
0
0
0
0
0
?
0
0
?
?
0
?
?
?
?
?
?
0
?
0
0
?
0
0
?
?
?
?
?
?
0
0
0
0
0
0
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
0
0
0
0
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
?
?
?
0
?
?
?
0
0
0
?
?
?
?
?
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
x
x
?
?
?
?
?
?
?
?
?
0
?
0
x
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
x
?
?
?
?
?
?
0
x
0
0
0
0
0
?
?
?
?
x
?
x
?
?
0
?
?
0
0
x
0
x
?
?
0
0
x
x
0
0
?
0
0
0
?
?
x
x
x
x
?
0
x
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
?
?
?
?
?
x
?
0
?
?
?
?
?
?
?
?
?
?
?
?
x
0
0
0
?
x
?
x
?
0
x
0
x
?
?
x
x
?
?
?
0
0
?
0
?
?
?
?
0
?
0
0
0
0
0
0
0
0
0
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
0
0
0
?
0
?
0
0
?
x
?
?
?
?
?
?
?
?
x
?
?
?
?
x
x
x
x
x
x
x
0
x
x
x
x
?
?
x
?
?
?
0
0
?
?
?
?
x
x
x
x
?
x
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
x
x
?
?
?
x
0
?
?
x
x
0
0
x
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.KLB
- Autoit
- BadJoke.FH
- DialupPass.A
- Emotet.CDD
Show More
- Injector.AK
- Lumma.GFD
- MSIL.Agent.GDE
- MSIL.Agent.OAAR
- MSIL.BadJoke.XF
- MSIL.BlackGuardStealer.A
- MSIL.Brute.BGF
- MSIL.Brute.GFA
- MSIL.Brute.X
- MSIL.DllInject.LE
- MSIL.Downloader.CCX
- MSIL.Filecoder.GG
- MSIL.Gamehack.JS
- MSIL.Heracles.IP
- MSIL.Injector.FSA
- MSIL.Tedy.F
- MSIL.Tedy.NN
- Remcos.AI
- Rugmi.IA
- Sheloader.A
- Sheloader.C
- Stealer.KF
- Zenpak.C
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\dav rpc service | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| \device\namedpipe\srvsvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\wkssvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\explorer\iconcache_16.db | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\explorer\iconcache_256.db | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\explorer\iconcache_idx.db | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\972ae312b9b3458a8bb8df383a9fb2b1\webview2loader.dll | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\a634fbb351864c07b1d9d3e2e2924438\webview2loader.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\aut7702.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ins4df8.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-64np1.tmp\_shfoldr.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-gde6n.tmp\cd526ab1a8cac6534a246050d8dd777b01a88e44_0006159650.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-lroid.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\temp0.jar | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\temp1.jar | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\~dffa55f81611a658c1.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\~vmlgywd.jpg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\~vmlgywd.jpg | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\local settings\software\microsoft\windows\shell\bagmru::nodeslots | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru\2::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bags\94\shell::sniffedfoldertype | Downloads | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer\mountpoints2\##10.200.31.10#amas::_labelfromdesktopini | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �j � 8��81��B�8 �6 �v y� xy �� �a ۀT�B� ����� 1���� �5����eeBx �<�� �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�x'�(�(X�)�`*J*9*�^+�[+��,=� ,��/9� /��1`1�1HO 1�D | RegNtPreCreateKey |
| HKCU\software\pc soft\windev\27.0\appli\36b07cc3f35c7250bfe20502a5825c16f399d30f_0009639936::last_framework | 270103j | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352 *1\??\C:\P | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62 *1\??\C:\P | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | `$�!�:i�� +00�� � Gs]XM��� "�2� � FX D�' :D��exA-� �LG=�A��J� �C� | RegNtPreCreateKey |
Show More
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\blbeacon::failed_count | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\blbeacon::state | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\thirdparty::statuscodes | (NULL) | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\thirdparty::statuscodes | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\elfbeacon::version | 143.0.3650.96 | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\blbeacon::failed_count | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\blbeacon::state | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �l � 8�tX�jg�8 �� �v xy �� �� T��������%�� �5����3bBx �� !wz #�#��$kF%:� %`� &� &�-(�(X�(�)�`*J*9*�"+�[-!R/9� /��0P%1`1�1HO 1�D5,]9ߔ>3� @V� A��B�� G�IH[uH�pJ�� K��N$N� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | g� xy * � /�� Y� d� � � �ރ �p ��^ �o � 8 Vs} kP~ ��1 ! �� 7 � �� ﺃ e e�� ��1 3 �� f e�� h �n� i U e�� r G | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �l � 8�tX�jg�8 �� �v xy �� �� T��������%�� �5����3bBx �� !wz #�#��$kF%:� %`� &� &�-(�(X�(�)�`*J*9*�"+�[-!R/9� /��0P%1`1�1HO 1�D5,]9ߔ>3� @V� A��B�� G�IH[uH�pJ�� K��N$N� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n �v����(�1`1�1HO @V� A��H[ue�vk`k�ql(�{b��P� ������ ������m� Ù� ����$�8წ���&M �=�SB1_ T�Vw���%����AE��D��&��$���L | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 鴳 ȁe ꙥ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n �v����(�1`1�1HO @V� A��H[ue�vk`k�ql(�{b��P� ������ ������m� Ù� ����$�8წ���&M �=�SB1_ T�Vw���%������ �AE��D��&��$���L | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n �v����(�1`1�1HO @V� A��H[ue�vk`k�ql(�{b��P� ������ ������m� Ù� ����$�8წ���&M �=�SB1_ T�Vw��9 ��%������ �AE��D��&��$���L | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n �v����(�1`1�1HO @V� A��H[ue�vk`k�ql(�{b��P� ������ ������m� Ù� ����$�8წ���&M � �=�SB1_ T�Vw��9 ��%������ �AE��D��&��$���L | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| User Data Access |
|
| Syscall Use |
Show More
22 additional items are not displayed above. |
| Other Suspicious |
|
| Anti Debug |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Encryption Used |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Keyboard Access |
|
| Service Control |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Nztewlcq\AppData\Local\Temp\is-GDE6N.tmp\cd526ab1a8cac6534a246050d8dd777b01a88e44_0006159650.tmp" /SL5="$60302,5666415,214528,c:\users\user\downloads\cd526ab1a8cac6534a246050d8dd777b01a88e44_0006159650"
|
jview.exe /cp:p "C:\Users\Hxejqwsr\AppData\Local\Temp\temp0.jar
|
open http://www.java.com
|
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://www.java.com/
|
C:\Users\Iohabbbc\AppData\Local\Temp\INS4DF8.tmp /SL3 $D037E c:\users\user\downloads\4391b40a52b8d9625888b7bbf429adae1f63049a_0002083550 2075779 2079152 61440
|
