Trojan.Agent.KFR
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 1,520 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 472 |
| First Seen: | May 23, 2025 |
| Last Seen: | July 20, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Agent.KFR on your system indicates a potential security threat. This report aims to provide you with general guidance on understanding and removing the detected threat. It's essential to approach this situation with caution and follow the recommended steps to ensure your system's security and integrity.
Table of Contents
What Is Trojan.Agent.KFR?
Trojan.Agent.KFR is identified as a Trojan-type threat, which means it is a type of malware that can cause harm to your computer system. Trojans are known for their ability to disguise themselves as legitimate programs, making them difficult to detect. The name "Trojan.Agent.KFR" suggests that it is a type of Trojan agent, but without specific details, it's crucial to focus on general removal and prevention strategies rather than attributing it to a specific malware family.
How Trojan.Agent.KFR Operates
Trojan-type threats like Trojan.Agent.KFR typically operate by exploiting vulnerabilities in software or tricking users into installing them. Once installed, they can perform a variety of malicious actions, including data theft, unauthorized access to the system, and installation of additional malware. These threats can also modify system settings and compromise security software to avoid detection. Understanding how Trojans operate is key to preventing future infections and protecting your system.
Symptoms of Infection
Symptoms of a Trojan infection can vary widely but often include unexpected system behavior, such as slow performance, frequent crashes, or the appearance of unwanted programs or toolbars. You might also notice changes in your browser settings, such as a new homepage or search engine, without your consent. Additionally, increased network activity without a clear cause could indicate that your system is communicating with command and control servers. Being aware of these symptoms can help in early detection and prompt removal of the threat.
How to Remove Trojan.Agent.KFR
- Boot your computer in Safe Mode with Networking. This will limit the malware's ability to interfere with the removal process and allow you to download necessary tools.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. Ensure the tool is updated with the latest definitions to increase the chances of detecting and removing the threat.
- Uninstall any suspicious programs that you do not recognize or that were installed around the time the threat was detected. Be cautious and only remove programs you are sure are not necessary for your system's operation.
- Reset your web browsers (Chrome, Firefox, Edge) to their default settings. This can help remove any malicious extensions or settings changes made by the Trojan.
- Reboot your computer and perform another full scan with your anti-malware tool to ensure that the threat has been completely removed. Repeat this process if necessary until no threats are detected.
Conclusion
Removing a Trojan-type threat like Trojan.Agent.KFR requires careful and methodical steps to ensure your system is thoroughly cleaned and protected. By understanding how Trojans operate and following the recommended removal procedures, you can significantly reduce the risk of reinfection and protect your personal data. Remember, prevention is key; keeping your software up to date, using strong antivirus programs, and being cautious with emails and downloads can help prevent future malware infections.
Analysis Report
General information
| Family Name: | Trojan.Agent.KFR |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
61893883a9f2e60d28bf24f46b72a715
SHA1:
98655baf4bb88e1ae48dbd4d6df60b979e6d9a6e
File Size:
2.93 MB, 2926592 bytes
|
|
MD5:
21597ec6477a729d5d85bc78fe991286
SHA1:
24e155b4b3e510e9eb1b0eb943afd24e729db56e
SHA256:
6B0E289D17F38DB67FA9C2FB846CA7394443F6BB997E9EE0BC286B86B9E640FD
File Size:
2.31 MB, 2308608 bytes
|
|
MD5:
0c60b8c71008328f9e2c9410a7127be0
SHA1:
0fb2a6949c2990ff434aecd02eeb562ce403b36a
SHA256:
CE79F6F97BA814CAB94D73F7099979BB989F2A72150E010CAB8A45DD2B1E7C80
File Size:
2.00 MB, 2000384 bytes
|
|
MD5:
4fed657fe051289756074ce94018f4fb
SHA1:
f605b5b50c7f192490f71f2ffbf96ebf5a69e1bd
SHA256:
8DB6F84690A6AC78DAB62DE728C65170755987F8706CCE3979D62D677270FC69
File Size:
1.34 MB, 1338880 bytes
|
|
MD5:
2fe4658dc701199938000b9b78a97292
SHA1:
4a8891f97bfbb570193b17538efe853fd34ef36b
SHA256:
2DD458CE238192A57B5A020DCF14DBFBC8E51BDF6EBF5D3326BF79183B2C3EDD
File Size:
2.92 MB, 2917376 bytes
|
Show More
|
MD5:
6db0f3fe712b3e465f37d323946dac59
SHA1:
94cfb700806fb5d423c92c7ef4ff0d5eccffc07e
SHA256:
78AA42F8520884A1FCB121D8DF8CDA0BE81DE9CD0F0A05C3CD581B4C49ED8059
File Size:
1.46 MB, 1464320 bytes
|
|
MD5:
d2c946fcb4ca0f23c80c2990eb4f0ed2
SHA1:
1ce469f7677254b1eb3d79a28dfce25ea7465305
SHA256:
FBB4AA12410E26A8AEB3F9437DE565EDD83121567D0FD709969F06257FB59341
File Size:
3.31 MB, 3314688 bytes
|
|
MD5:
06539f1edea3036cf70da4c8fbe9498c
SHA1:
ad3b2dd78fda4f3c85a629ccf15fa2c54bb4de70
SHA256:
EC9BD70592A92C297D14F33C2A5AF90DA20A2062F2F40277FBCE9467B31F68A3
File Size:
1.23 MB, 1230064 bytes
|
|
MD5:
84a2f10b49239d837e9d5c342025e828
SHA1:
a6ddf97dc32213f52492fb93918013ad2682d5d3
SHA256:
3B76ADF2C5F1E79709428F6F524539531784EF5C6E3EFA85F7899EB202A05ACF
File Size:
2.29 MB, 2292224 bytes
|
|
MD5:
bedecda5532078579cfa8dcca09dfe0e
SHA1:
03fa1944c6665d79cc824aa33c83b244d7cb2c0a
SHA256:
750796FC32A748CC6DA1016FBE90AD2B62880571AADF43500B7333348CE2AF43
File Size:
2.75 MB, 2752512 bytes
|
|
MD5:
588449dd5b4577808b567d07d93350dd
SHA1:
8a170642d6e70c859fef4f01911d5d81f37b4757
SHA256:
78D07571FDAA452967B25A1C0ACA258D813EAD609D30D11E13FD22DEBDF55FEF
File Size:
2.15 MB, 2146816 bytes
|
|
MD5:
01ddaacfc7d524f4740e5ff3bfd8ed24
SHA1:
ff23a9d1d41d19de6f9ea18c467f24add882e591
SHA256:
629CA081D2BEA54D6288615A8187EE9B8534C26470604BD23080C30F15147D97
File Size:
5.10 MB, 5099520 bytes
|
|
MD5:
03bf26b5a804df98347872fdcb945260
SHA1:
9c0cbe57657e2f9f91b869868e8af099b3745ec0
SHA256:
0AAD023CBE1512FC4483F811DC60096DDD3BA0EBD777901963533AD55C12641F
File Size:
2.49 MB, 2489856 bytes
|
|
MD5:
c8694ed497c950e3c250c316143b0935
SHA1:
38588626a7da59664296a6add0967f0871d929ee
SHA256:
81A6798D74A990EE59380B77C74841876DC8FEE51AE2E7FC09CCD92C44E2CAB6
File Size:
2.16 MB, 2160640 bytes
|
|
MD5:
d4fce039d962601880307495a145ad77
SHA1:
9fb3dd20594b594e2b8e988505c953368aef71f5
SHA256:
21E63AE77BD1E04867451E3E7888772E8F9A65FC688D3B4A2AAF78DB6E8E8F34
File Size:
2.82 MB, 2819072 bytes
|
|
MD5:
5fb936a195c0f977dd17150d3aab043b
SHA1:
12579c4b3b3225b049f7783346ec2c1667b97527
SHA256:
57869C24C3F0F948CCA1C6DF6B38418C14CF20AFA599BCF5C4CC191982EC57BF
File Size:
2.62 MB, 2619392 bytes
|
|
MD5:
2782d98d8d87ea594b02c4df5e942673
SHA1:
af70b3c5d4eb9746ead349f9e0ee98e2afb4d69a
SHA256:
F2E8A4E0383E5A0F19A9716EF48E34CCD2EF17A76C004EAAA3A021B5B84D4941
File Size:
1.78 MB, 1780224 bytes
|
|
MD5:
9bab9f959e7c8aff4acd4a3aa97729dc
SHA1:
26b0f24d1e6018c1c90c548fd4c1b6f4dc60aa6f
SHA256:
9BFC152FDDA7D96A62066BD89B2BD1FBF5CEB20E7C07127889A1B67EF0806412
File Size:
2.83 MB, 2834944 bytes
|
|
MD5:
317cea2eb8711f94fd449b8af1efddf2
SHA1:
8c713c85749ba4418e3e973547b19da70d078c76
SHA256:
84682215D205E8BE03048153602E23742CD76E8E45EAA802A618D8DC81818D6D
File Size:
6.35 MB, 6351360 bytes
|
|
MD5:
a48f078074db2ea7f4c86fa18e21eef2
SHA1:
1dbf42b8bee5fab987fa2ced325c2b17b1e4824a
SHA256:
534430BE58995DDB6AE40D929618550479958933BA11564873E3303A5375818E
File Size:
2.17 MB, 2174976 bytes
|
|
MD5:
742c29b66ccfc3be0750221ce46780f5
SHA1:
b372259b636ae0bf17209d60c1ae62cdf2379510
SHA256:
6EA015E59A84A76F135B5ABDCDBDDB2513AF7948FAED6A54020B045CF0DD9A6D
File Size:
1.33 MB, 1333760 bytes
|
|
MD5:
d3e801eebb4bdf63c29c52cf0bbe63be
SHA1:
32cc16722557652e68146b43fd2325a7bc06ce6c
SHA256:
E3A7B36562E2E75FA6FFDD327C0FBBA9060E7FC57D877C61E311BE0E6130AC7A
File Size:
5.28 MB, 5283840 bytes
|
|
MD5:
c5f09c4ea01bb995ffc6a665eb9e3879
SHA1:
5f69208f1ddefba47b9a944acb12378da0ad672a
SHA256:
FCD72E64A8BE28DC2A4FED09B8D89BE964FF98E6588DE6DC36AE21F689548246
File Size:
5.66 MB, 5658624 bytes
|
|
MD5:
b18c4f7ef40a8e60aa0a1b3c6b54e2c3
SHA1:
43f4f1cae3b20f0ab411cf8ace9660ab459f3643
SHA256:
935AA0DB21DF1A75EA835BC5B48064EE0429529E5250AEFA83C0249DC4A51841
File Size:
6.37 MB, 6370816 bytes
|
|
MD5:
3760f9e7520967a2128dee9ad7b7180d
SHA1:
205a9cec34dde526116fb848f22331e0dbdc61e9
SHA256:
6FAF545B6E7F569F53C342428A4ADCF2BC66834AA158CAA03DFDBB78F9BB2655
File Size:
1.48 MB, 1481728 bytes
|
|
MD5:
be6748df7a82d2932d32dec646b36d88
SHA1:
fcb47edaa0c8e038890b1361ed4d4e2abd35ec98
SHA256:
B15A85320B024CCC42C3B5D1E4A1FFFFFECFAC27B9E3DC4AFF9849CCB6BF15C5
File Size:
2.30 MB, 2297856 bytes
|
|
MD5:
4ac2884dcb47b521ca72c71df69267bb
SHA1:
c51477a168a8adf39b2a5cd52156d1b57cb8ad21
SHA256:
61DC3F1B2BBCE609D256C322A4379602DC78882CA8BA7B8B862D94B21FA37D8A
File Size:
2.70 MB, 2699776 bytes
|
|
MD5:
da8b99c0996fbeb9a5ea0e81834cec92
SHA1:
1fd2703cdf4cb6fced0c14def030e150920992c1
SHA256:
311CF318FFA0F2EE4B6B3E1C0BFA6E79512F2E3ACBEE00BEA3E2796BD5246F0E
File Size:
5.08 MB, 5080576 bytes
|
|
MD5:
83878890dd1d02a65ef69b408c8f0c0e
SHA1:
1ffb0cb6bc1254d590996bb45c1756037cf136b6
SHA256:
959F4AD4BADBA3EC6FC869C5DC95738E321BC0CA6DE3BCEE7818276C118E2A0E
File Size:
1.35 MB, 1353216 bytes
|
|
MD5:
fb8e1a5c9351361e3648badea105e7a6
SHA1:
cc798323c53e1b547d00c140809e89db7b84b42c
SHA256:
555A571610BE6B881AAE4793F5518DABED019E27E574D1AA2B6EE5802F6E232A
File Size:
2.44 MB, 2444288 bytes
|
|
MD5:
111be6838ba447d58062c4d9708bd3aa
SHA1:
73bb8cde2353a848492bff02c46695ad266298a7
SHA256:
2416EE01A552F10108BAA0D465229CE37B6C04C02572503219E54247253397D6
File Size:
1.57 MB, 1569280 bytes
|
|
MD5:
ee01d9ece828ca69aa0afe4995ddb462
SHA1:
be582f5d6bec7c50f1a8a41d09c6b86c17ef270e
SHA256:
7C8315936A5406CC46DBFAB1CD7E53D366CA307E0B67A093AAFD60A296B9ACDC
File Size:
2.93 MB, 2928128 bytes
|
|
MD5:
9c37fba5f90bdf2741650619d0a2bf0b
SHA1:
04e71669b4792e870b8f4c0344ac4b24fc446a0b
SHA256:
4B5F2FFA60D630DEBA2157077998D686CCD7C206C1A7A4DA212459C12E5C83A1
File Size:
7.29 MB, 7286784 bytes
|
|
MD5:
bda23c54c96bb7acc0870988d5a15931
SHA1:
26b7b362ccb7daa74ea989e8eac034672a7f5027
SHA256:
D9DF6B577D313D82EE62ED14C570A67BD3CBF995A6592236D0CF1D81996F505F
File Size:
2.84 MB, 2841088 bytes
|
|
MD5:
d476b3ec07be2721f2a139ed21631e3b
SHA1:
a20859a96339854b7f9ecb75cb164dd2acabd18b
SHA256:
4271B3E35349E242298EF4735E60708167B6EBFE81DC7071C19AD9A78105E5D1
File Size:
3.81 MB, 3811840 bytes
|
|
MD5:
176d3dfd7e9087c53aea2b164fe69d63
SHA1:
35caf85d5526d310901b66340c7badb368fbc33c
SHA256:
388759592C832045C46CA22A255EFF99B04E3D105B0D30ECDC6BBEE545AE10AC
File Size:
7.52 MB, 7517184 bytes
|
|
MD5:
f1becc5061e597f5e50b95ce1d6d7c54
SHA1:
605d0730a80e4c14d7aeefae1b7b239d25df0e65
SHA256:
DBC7663042E6AEF581D13BC2159285CC5D2DBB4E658293BEC94B32A5C49007FC
File Size:
2.65 MB, 2653696 bytes
|
|
MD5:
d3909a79d05b545a664dbcea2a27cf1d
SHA1:
002e3f58a4be772e01d65b4906b7e4d4e9c328f0
SHA256:
58F57958A9DBFDD166AF6DA686613B9F5BE74EE1871D0531CEC425970FEE5C1E
File Size:
9.97 MB, 9972736 bytes
|
|
MD5:
c20dcd7342a0069c86534a5c53f4291d
SHA1:
53d10e583d65e1cad04a16f171cc6071c280b8e8
SHA256:
CFB3EE3A1AC297E4F72B203AC00009CBBA17C1E1A8B1933175DE50DD5789579A
File Size:
3.86 MB, 3860992 bytes
|
|
MD5:
b6244acda73f451be2ab6b6937df566f
SHA1:
1391a2a2426d83c1271438bfc1c339ad2ee485a4
SHA256:
338DA2E95F589146E3EB40093F20F7B9B0BFD9615A3FDA73939ADF09D5844F4E
File Size:
4.55 MB, 4548096 bytes
|
|
MD5:
2c66e586f0171f91780248058137117d
SHA1:
634c60fd7ea457ea210bf6d5ffcccba53e7df8a1
SHA256:
E6963BAC2D8CA85F908580344CB910788007E46CA4742FAD16B821D262AE1085
File Size:
4.81 MB, 4808192 bytes
|
|
MD5:
cf4697943d6fb1e71924780543aed60f
SHA1:
34ceee09766297788b4bab653ccea509a135891d
SHA256:
3F660E26DDD8E6B90AD9FFF23BB0C9A7755B82574F820FC4317D82CF3B5E5B06
File Size:
6.34 MB, 6342656 bytes
|
|
MD5:
36e8da65abb24e8221f7d6d810dda98b
SHA1:
f299f6f29e0754392021e8b0242e016f029d48f3
SHA256:
EF4E4956418DD0C8A2E4D3F60BE8371B874359AED30C9DB725776B4BAC2FF726
File Size:
1.36 MB, 1356288 bytes
|
|
MD5:
08e6a7ba6ed5fa1c0e60b0621adabab8
SHA1:
116965404683e8eb2d093e0814544009b23242a2
SHA256:
6B7D2C45AC7C58644103DB8914BF95450C4D44428A225AA814B13C0414A39A72
File Size:
6.82 MB, 6816768 bytes
|
|
MD5:
63564ac57a0d8f34311d0bc5eca8e1a7
SHA1:
4f77f6718f22cfea0760861beed47c8ffc4e6d02
SHA256:
B95A57DCE2EE5BD0D223A321FE14393486FDA62E2C213648DB33A676F793BE25
File Size:
3.09 MB, 3091456 bytes
|
|
MD5:
354abb72a884714e7b60965ad9e45335
SHA1:
7bc689cddc1ec9b6fc85e0fdf889fc6a4e65eb16
SHA256:
BE1841301C2F810396DAB0892D7F35CBEA773AF6CAA60014DD0E28B1DC96DFC9
File Size:
2.09 MB, 2089984 bytes
|
|
MD5:
6283eb403f7f68bce1b25b51a3dac22f
SHA1:
a74a68db315df905bc9f4c426fe5a8aba08f6987
SHA256:
9635786798ABD0CF49BE0C14623399921826137C967EB893B2FD500E046270F0
File Size:
3.83 MB, 3829248 bytes
|
|
MD5:
a116e9c0220df1dab672f4a65297f53f
SHA1:
3d86d5bb803400f9fe88d9a406ec1c9c89f48a45
SHA256:
621D88D74A616BAD287F1CC249E369567538FC60DB76137317B22008FC9DF573
File Size:
1.98 MB, 1976832 bytes
|
|
MD5:
15be5a4aa3529b5d86f5060013361921
SHA1:
f3aa9fc6b2551fbc1800f19f69f3690381a1a734
SHA256:
EE39F5FDAD7AB2650AD2A1A2E7A534FD916349B0A0612939262CF5ABDF9A46EE
File Size:
7.86 MB, 7856640 bytes
|
|
MD5:
4ff19a7cc2b45c59d4a9659a02e71eb7
SHA1:
0525f39bd7b67957a418cbde7ac95b98cc848944
SHA256:
8BC22F077C0984BAAC135C94E58643F473C5BEA18648D499116A8A5585C6CCC0
File Size:
3.83 MB, 3826176 bytes
|
|
MD5:
6b441a8077f8c603843784e0440b690b
SHA1:
82bdcb32ec67e8950f367d8289bd1817f37774db
SHA256:
A8D92E5701F7CC2E5ECCE533993554F9D93A5614A381717018EAFFA3893372F0
File Size:
9.76 MB, 9764305 bytes
|
|
MD5:
34c0bb161d75cf07352c8af51f9ea4cc
SHA1:
f4e3076160d3efd66cb611813214df05876eb8f8
SHA256:
AB3C6147DFB4F5BD4F24F1D408CCE351A0130AB5EEE3B442119ADCDAB0A2E6A0
File Size:
6.07 MB, 6067712 bytes
|
|
MD5:
d5c5d0d075d1f304f3ba4dfda1907ba1
SHA1:
642053787eee70866a5128f42d2e00f5f91724b2
SHA256:
FFB026222536EB9D9399CEB45F356048181A9D844B9817F63294B4B706429F6C
File Size:
6.07 MB, 6068224 bytes
|
|
MD5:
922fa0630e2b133ba4b479dbf65c0541
SHA1:
d787f70b034f0849fc92545d7a4a2e188084583e
SHA256:
FA39216A1947EA91ECC96136E512B574B3C85CBF72E9B98EC03FD5342FC96FBA
File Size:
4.98 MB, 4975104 bytes
|
|
MD5:
dfd0ca6905b90123f3bafa9777a1d809
SHA1:
acc3f723b4426988f276ddb653bce8fb13b59419
SHA256:
D5638F91E3748E247CDC7BAEFBEEB7FB7DDC251D9871903DD176AFE7070B2B00
File Size:
3.59 MB, 3587584 bytes
|
|
MD5:
93b3b6c24c0e37fe718a478e7f9b6285
SHA1:
d5a499757b95791350a1825280ee927f1da420c9
SHA256:
83185EA09B2AAA32B57BF8E6363380E8B46F821FA089959D0005C3684B11AF5C
File Size:
3.47 MB, 3468400 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is 64-bit executable
Show More
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Legal Trademarks | Kiero |
| Original Filename |
|
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Microsoft Corporation | Microsoft Code Signing PCA 2011 | Hash Mismatch |
File Traits
- CryptUnprotectData
- Discord
- dll
- GetConsoleWindow
- HighEntropy
- imgui
- No Version Info
- ntdll
- Pastebin
- VirtualQueryEx
Show More
- WriteProcessMemory
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,918 |
|---|---|
| Potentially Malicious Blocks: | 145 |
| Whitelisted Blocks: | 2,356 |
| Unknown Blocks: | 417 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
?
x
?
?
?
0
0
?
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
?
0
0
0
0
0
0
?
?
?
0
0
?
?
0
?
?
?
?
?
?
?
0
?
?
0
?
?
0
0
?
?
?
0
0
0
?
?
?
0
0
0
0
0
x
?
0
0
?
?
?
?
?
?
?
?
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
1
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
0
0
?
0
0
?
0
0
x
?
?
?
?
?
0
?
0
?
0
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
x
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
?
0
?
0
0
0
0
1
0
0
0
0
0
0
0
0
0
?
0
0
?
0
?
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
x
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
?
?
0
?
0
?
?
?
0
0
0
0
0
1
?
?
0
?
?
?
?
0
?
?
0
?
?
0
?
0
0
0
?
0
0
?
0
?
0
0
?
?
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
?
0
0
0
0
0
x
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
?
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
?
0
0
0
?
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
0
0
?
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
?
x
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
0
0
0
x
0
x
?
0
?
x
x
0
0
0
0
0
0
0
0
1
0
0
x
0
0
0
0
0
0
0
x
x
0
0
x
x
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
?
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
x
0
0
0
0
0
0
0
0
x
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
?
0
x
0
0
0
0
0
x
x
0
0
0
0
0
0
0
x
0
0
x
x
x
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
x
0
0
0
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
x
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
x
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
x
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
?
0
0
?
0
?
0
0
x
0
0
?
0
0
0
0
0
x
x
x
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
1
0
0
1
0
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.TRG
- Gamehack.CAA
- Gamehack.DSE
- Gamehack.EBB
- Gamehack.GACH
Show More
- Gamehack.GDDG
- Gamehack.GDDH
- Gamehack.GSH
- Gamehack.GYF
- Injector.KFSC
- Kryptik.DTE
- Kryptik.EFJ
- TelegramHack.C
- TelegramHack.G
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| \device\namedpipe\uoqcyskxsuxxjnpvqyatphqwyogfhcbh_5036 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\uoqcyskxsuxxjnpvqyatphqwyogfhcbh_6420 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\synaptics | Synchronize,Write Attributes |
| c:\programdata\synaptics\rcxc0a5.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\synaptics\synaptics.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\programdata\synaptics\synaptics.exe | Synchronize,Write Attributes |
| c:\programdata\synaptics\synaptics.exe | Synchronize,Write Data |
Show More
| c:\users\user\appdata\local\temp\crwpw2y.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\dll_exe_dump_boh.bin | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\dragonburn-tmp\dragonburn-kernel.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\dragonburn-tmp\dragonburn-kernel.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\dragonburn-tmp\dragonburn-usermode.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\dragonburn-tmp\dragonburn-usermode.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winsl | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winsl\l3\31\2026 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\._cache_35caf85d5526d310901b66340c7badb368fbc33c_0007517184 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\._cache_35caf85d5526d310901b66340c7badb368fbc33c_0007517184 | Synchronize,Write Attributes |
| c:\users\user\downloads\configs\vexor.cfg | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 㷮ྫྷ㐼ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 슼ၯ㐼ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 曐䖡ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 庫ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 㵘 ȁ 獖} | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沋 䠱O噀ñʁ뽹ɞ傄ë鶝駃óߙĤ É | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沌 䠱O噀ñʁ뽹ɞ傄ëķ鶝駃ó䧌VߙĤ⣳ġj 鈄ĞꩠŖÉ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沍 䠱O噀ñʁ뽹ɞ傄ëķ鶝淃駃ó䧌VߙĤ⣳ġj 鈄ĞꩠŖÉ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 䓫庫ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 먌庫ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 쳯庫ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 䇼庫ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 庫ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ઌ搂脜ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | @k �v#��(�1�1HO @V� H[uH�pj�bl(��P� �/�����b:��� �X��Rc�a �m� � �gi�$����j AB1_ B�� ��� �zH | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 镉졧ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | `$�!�:i�� +00�� � Gs]XM��� "�2� � FX D�' :D��exA-� �LG=�A��J� �C� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | k 8��81��B�8 �6 �v y� �Z xy �� �a ۀT��� B� ����� 1���� �5����eeBx �<�� �� �R �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�x'�(�(X�)�`*J*9*�^+�[+��,=� ,��/9� /�� | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\run::synaptics pointing device driver | C:\ProgramData\Synaptics\Synaptics.exe | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | � xy * � /�� Y� d� kP~ � � �ރ �p ��^ �o � ee4 Vs} kP~ ��1 . �� 7 � �� ﺃ e e�� � ��1 �� f e�� g � | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | k 8��81��B�8 �6 �v y� �Z xy �� �a ۀ�� T��� B� ����� 1���� �5����eeBx �<�� �� �R �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�x'�(�(X�)�`*J*9*�^+�[+��,=� ,��/9� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | k 8��81��B�8 �6 �v y� �Z xy �� �a ۀ�� T��� B� ����� 1���� �5����eeBx �<�� �� �R �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�x'�(�(X�)�`*J*9*�^+�[+��,=� ,��/9� | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 邖떈쿇ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | Pl �v����Bx (�1`1�1HO @V� H[uN$k`k�ql(��P� ��!���� � ��3�� ��� �m� � �V �$�8���l� �~ B1_ `�V����� �Q] �� @ K� A *�" C ��| | RegNtPreCreateKey |
| HKCU\software\roblox\velwocity::fuswamvczzxlxdel | F7JPOmwFga7wTYHnnSdAaKuvLHLVVHHf | RegNtPreCreateKey |
| HKCU\software\roblox\velwocity::fuswamvczzxlxdel | 1WnSVD5etPXdyrNit4Z403VbCQCWQOqd | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
27 additional items are not displayed above. |
| Process Shell Execute |
|
| Network Winsock2 |
|
| Network Winsock |
Show More
|
| Anti Debug |
|
| User Data Access |
|
| Process Terminate |
|
| Process Manipulation Evasion |
|
| Service Control |
|
| Network Info Queried |
|
| Network Wininet |
|
| Network Winhttp |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\system32\curl.exe curl -s -X GET https://raw.githubusercontent.com/ByteCorum/DragonBurn/data/version
|
(NULL) C:\Users\Hbmpscbn\AppData\Local\Temp/DragonBurn-tmp/DragonBurn-usermode.exe
|
C:\WINDOWS\system32\curl.exe curl -s -X GET https://api.jsonbin.io/v3/b/690e4759ae596e708f4b20b3
|
WriteConsole: The current dire
|
WriteConsole: Press any key to
|
Show More
WriteConsole:
|
runas c:\users\user\downloads\._cache_35caf85d5526d310901b66340c7badb368fbc33c_0007517184
|
runas C:\ProgramData\Synaptics\Synaptics.exe InjUpdate
|
