Threat Database Trojans Trojan.Agent.Gen.FBV

Trojan.Agent.Gen.FBV

By CagedTech in Trojans
Published:
Last updated:

Threat Scorecard

Popularity Rank: 16,661
Threat Level: 80 % (High)
First Seen: August 31, 2026
Last Seen: September 21, 2026
OS(es) Affected: Windows

Trojan.Agent.Gen.FBV is a dangerous Trojan horse that targets Windows computers. It is designed to quietly infiltrate a system, run hidden in the background, and carry out malicious instructions without the user's knowledge. With a danger level rated 8 out of 10, this threat should be taken seriously by anyone who suspects it may be present on their machine.

What Trojan.Agent.Gen.FBV Does

Once active on a system, Trojan.Agent.Gen.FBV operates silently in the background, avoiding obvious signs that would alert the user. It is built to give remote attackers a foothold on the infected machine, potentially allowing them to gain significant control over the system. Analysis of its behavior shows it is capable of manipulating Windows processes and using low-level system calls to interact with files, memory, and security tokens, techniques often used by malware to hide its activity or escalate its privileges.

Notably, this Trojan has been observed attempting to run a hidden PowerShell command designed to add an exclusion path to Windows security settings. This type of behavior is typically used to prevent security tools from scanning or flagging a specific folder, which can allow additional malicious files to be downloaded or executed without detection. This indicates the Trojan may be clearing the way for further malicious payloads or tools to operate undisturbed on the infected computer.

How It Usually Gets Onto Computers

Trojan.Agent.Gen.FBV typically spreads through deceptive or exploit-based methods common to this category of malware. It often installs itself stealthily by taking advantage of unpatched system vulnerabilities and security flaws. Common infection paths include downloading software from malicious or compromised websites, and opening email attachments from untrusted or unknown senders. These attachments can be disguised with familiar-looking extensions such as .exe, .pif, .avi, or even .jpg files, tricking users into opening what appears to be a harmless file.

Risks for the User

The presence of this Trojan on a system poses serious risks. Because it can grant attackers a high level of control over the infected computer, it may be used to steal sensitive data, install additional malware, monitor user activity, or use the compromised machine as a launching point for further attacks. Its ability to modify security settings, such as adding exclusions, can leave the system exposed to additional infections that would otherwise be blocked.

Signs of Infection

Trojans like this are built to avoid detection, so visible signs may be subtle or absent. Users should watch for:

  • Unexpected slowdowns or unusual system behavior
  • Security software being disabled, altered, or showing unfamiliar exclusions
  • Unknown processes running in Task Manager
  • Unexpected network activity or data usage
  • New or unfamiliar files appearing in user folders

How to Stay Protected

To reduce the risk of infection, users should keep their Windows operating system and all software fully updated to close known security vulnerabilities. Avoid downloading programs from unofficial or suspicious websites, and never open email attachments from unknown or unverified senders, especially executable files or files with unusual extensions. Maintaining reputable, up-to-date security software and performing regular system scans can help detect and remove threats like Trojan.Agent.Gen.FBV before they cause serious harm. Regularly reviewing security settings and exclusion lists can also help catch unauthorized changes early.

Analysis Report

General information

Family Name: Trojan.Agent.Gen.FBV
Signature status: No Signature

Known Samples

MD5: c5f84de99312955e298fd47bb1e3f1fa
SHA1: 73f969a2cbff7f6184192566500acdc32f0b3777
SHA256: B8B9654B57A0445EA1F5645D0F6063DF790448DEA4D5AE27D502A2B136BB8DA1
File Size: 295.42 KB, 295424 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File doesn't have security information
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • No Version Info
  • x64

Block Information

Total Blocks: 928
Potentially Malicious Blocks: 31
Whitelisted Blocks: 897
Unknown Blocks: 0

Visual Map

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

Registry Modifications

Key::Value Data API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe ࠧ뭧䀉ǝ RegNtPreCreateKey

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
Show 27 more
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWriteFile
  • UNKNOWN
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess

Shell Command Execution

powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Nopbwvhz\AppData\Local\YAFO'"