威胁数据库 特洛伊木马 Trojan.Agent.LOFG

Trojan.Agent.LOFG

通过CagedTech在 特洛伊木马
发布时间：
最后更新：
翻译为：

Trojan.Agent.LOFG是一个检测名称，用于识别木马程序。木马程序是一种恶意软件，它会伪装成合法或无害的程序，以入侵计算机系统。由于“Agent”家族中的检测结果通常是通用分类，因此 Trojan.Agent.LOFG 可能代表的是一个与其他已知木马程序在行为或代码上具有相似性的程序，而不是一个单一的、定义明确的威胁。与大多数木马程序一样，它的主要目标是未经授权访问系统，并在用户不知情或未经同意的情况下执行有害操作。

Trojan.Agent.LOFG 的作用

与其他同类威胁一样，Trojan.Agent.LOFG 通常在安装到设备后会在后台静默运行。此类木马通常能够执行一系列恶意活动，包括下载和安装其他恶意软件、修改系统设置、从受感染的设备收集信息，以及允许远程攻击者控制计算机的某些功能。这类威胁通常会试图在系统中保持持久性，这意味着即使重启系统，它也可能试图继续运行，从而使用户难以通过简单的方法将其清除。

它通常是如何进入电脑的

这类木马程序通常通过欺骗手段传播，而非仅仅利用安全漏洞。典型的感染途径包括恶意电子邮件附件、虚假软件更新、来自不可信网站的捆绑下载、破解或盗版软件，以及通过钓鱼邮件或被篡改的广告传播的链接。由于木马程序依赖于诱骗用户执行，因此它们通常会伪装成合法的文件、文档或应用程序，使用名称或图标进行伪装。

用户面临的风险

感染此类木马程序会使用户面临多种风险。这些风险包括个人或财务信息被盗、设备遭到未经授权的远程访问、系统性能下降以及安装其他不需要的恶意程序。由于木马程序通常被用作进一步攻击的入口，因此，一旦系统被 Trojan.Agent.LOFG 感染，就更容易受到其他恶意软件（包括勒索软件或间谍软件）的攻击，具体取决于该威胁旨在传播哪些其他有效载荷。

感染迹象

由于木马程序旨在隐蔽运行，因此可能很少出现明显的症状。但是，用户应注意此类恶意软件的典型警告信号，例如系统性能无故下降、异常网络活动、后台运行的陌生程序或进程、未经用户更改的浏览器或系统设置，以及浏览网页时弹出窗口或重定向次数增多。安全软件将文件标记为 Trojan.Agent.LOFG 通常是此类威胁存在的最明显迹象。

如何做好防护

为降低感染风险，用户应避免从非官方或不可信来源下载软件，谨慎对待来自未知发件人的电子邮件附件和链接，并保持操作系统和已安装应用程序的更新。定期使用信誉良好的安全软件进行系统扫描、启用防火墙保护以及养成安全的上网习惯，也是降低感染此类木马程序风险的有效方法。如果怀疑感染了木马程序，必须立即采取措施清除威胁，并检查系统是否存在其他更改或安全漏洞。

分析报告

一般信息

姓： Trojan.Agent.LOFG
签名状态： No Signature

已知样本

MD5: 8a96b62a98c1d60eaaad112aeabc173f
SHA1: c73d59062da08fc8585ae82f4f360a72f931f25c
SHA256: A4C0A535E1488DD61E184CCA1DE7F02595BE6C29B35F62FF5DC7E4A8CA3938E0
文件大小: 6.63 MB,6626816字节

Windows 可移植可执行文件属性

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File doesn't have resources
  • File doesn't have security information
  • File has TLS information
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
显示更多
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

文件特征

  • CryptUnprotectData
  • fptable
  • No Version Info
  • ntdll
  • x64

区块信息

总区块数： 15,701
潜在恶意块： 228
白名单区块： 15,473
未知区块： 0

可视化地图

0 0 0 0 0 0 0 0 0 x x x x x x x x 0 0 0 0 0 0 0 0 0 x 0 0 x 0 0 x 0 0 x 0 0 0 x 0 0 0 0 0 0 x 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 x 0 x 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 x x 0 0 x x x 0 x x 0 0 0 x x 0 x x 0 0 0 x 0 x 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 x x x 0 0 0 0 0 x 0 0 x 0 x 0 0 0 x 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 x 0 x 0 0 0 0 0 x x x x x x x x x x x x x x x x x x x x x x x x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... 数据已截断
0 - 可能的保险箱
? - 未知区块
x - 潜在恶意拦截

相似家庭

  • Agent.LOFG

文件已修改

文件 属性
\device\namedpipe Generic Write,Read Attributes
c:\users\user\appdata\local\bridge\.supervisor.heartbeat.json.new-bdf-cdvv Generic Write,Read Attributes
c:\users\user\appdata\local\bridge\.supervisor.heartbeat.json.new-xim1sr42 Generic Write,Read Attributes
c:\users\user\appdata\local\bridge\agent.db Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\bridge\agent.db-journal Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\bridge\agent.db-shm Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\bridge\agent.db-wal Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\bridge\legacy-migration-v1.complete Generic Write,Read Attributes
c:\users\user\appdata\local\bridge\logs\bridge-agent.log Read Attributes,Synchronize,Read Control,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\bridge\supervisor.heartbeat.json Synchronize,Write Data
显示更多
c:\users\user\appdata\local\programs\bridge\bridgeagent.exe Synchronize,Write Data
c:\users\user\appdata\local\programs\bridge\bridgeagent.new.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144

注册表修改

键::值 数据 API名称
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe ꆡ設佌ǝ RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::bridgeagent "C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 挮詰佌ǝ RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::bridgeagent "C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 猺諁佌ǝ RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::bridgeagent "C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor RegNtPreCreateKey

Windows API 使用情况

类别 API
Syscall Use
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateIoCompletion
显示更多
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateNamedPipeFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFlushBuffersFile
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtLockFile
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryObject
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRemoveIoCompletionEx
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetIoCompletion
  • ntdll.dll!NtSetTimerEx
  • ntdll.dll!NtSetValueKey
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTerminateProcess
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnlockFile
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Anti Debug
  • IsDebuggerPresent
User Data Access
  • GetUserObjectInformation
Process Terminate
  • TerminateProcess
Cert Store Read
  • CertOpenStore
Network Winsock2
  • WSASocket
  • WSAStartup
Network Winsock
  • bind
  • closesocket
  • connect
  • setsockopt

Shell命令执行

C:\WINDOWS\system32\reg.exe "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe "C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor
C:\WINDOWS\system32\reg.exe "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe "C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 9752
C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe "C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor --adopt-runtime 4324
显示更多
C:\WINDOWS\system32\reg.exe "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Snetxjdb\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f