Trojan.Bestafera.E
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 14,552 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 112 |
| First Seen: | November 9, 2021 |
| Last Seen: | November 6, 2026 |
| OS(es) Affected: | Windows |
Trojan.Bestafera.E is a Windows Trojan with a danger level of 8 out of 10. Trojans pretend to be harmless or hide inside other content, then work against the user once they are on the system. Bestafera.E was first seen on 2021-11-09 and most recently on 2026-11-06. The feed records 112 detections, so it has stayed active for a long time.
Table of Contents
What the threat does
According to the feed, Bestafera.E installs itself stealthily and then runs silently in the background while performing malicious functions. The description says it may give hackers complete control over the infected system. It may also covertly delete files and install additional software. The description is cut off at that point, but it is typical for Trojans of this kind to download further malware once they have a foothold.
The sample data describes the file as a 32-bit native Windows executable (not .NET) with a graphical subsystem, so it does not need to show a console window. It is not packed, has no version information, no digital signature information, and no debug information. It has more than one executable section and contains TLS information. The feed lists its signature status as "No Signature".
How it usually gets onto computers
The feed names three main routes:
- Exploiting system vulnerabilities and security flaws.
- Software downloads from malicious websites.
- Email attachments from untrusted sources, usually .exe, .pif, .avi and even .jpg files.
The file types matter because an attachment that looks like a picture or a video may actually be an executable program. Double extensions and familiar-looking icons are common tricks, though the feed does not say whether this threat uses them.
Risks for the user
Full remote control is the most serious risk named in the feed. Typically, an attacker with that level of access can view or copy personal files, capture typed information, change settings, and use the computer for further attacks. The feed specifically mentions covert file deletion and the installation of additional software, so a single infection can lead to data loss and more infections.
The feed also lists block statistics for this detection: 4,040 in total, of which 3,978 are whitelisted, 42 are potentially malicious and 20 are unknown. This suggests that files and activity linked to the threat can be mixed in with ordinary, harmless items, which makes manual checking unreliable.
Signs of infection
The feed says Bestafera.E runs silently, so there may be no obvious symptoms. These are the signs commonly associated with Trojans of this type, not confirmed behavior of this specific threat:
- Files that go missing or change without your involvement.
- Unfamiliar programs or processes that you did not install.
- A slower computer or unexpected network activity.
- Settings that change on their own.
- Security tools that stop working or cannot be opened.
How to stay protected
- Keep Windows and all installed programs up to date, since the threat can exploit known flaws.
- Download software only from the official publisher's site and avoid unknown download pages.
- Do not open attachments from senders you do not know. Be suspicious of a .jpg or .avi file that behaves like a program, and of any .exe or .pif file.
- Turn on file extension display in Windows so you can see a file's real type.
- Use a reputable, up-to-date security solution and run a full system scan if you suspect an infection.
- Keep regular backups on a drive or service that is not permanently connected to your PC, so deleted files can be restored.
If you think Bestafera.E is on your computer, disconnect it from the internet, run a full scan with an up-to-date security tool, and remove what it finds. Afterwards, change important passwords from a clean device, because a Trojan with remote access may have exposed them.
Analysis Report
General information
| Family Name: | Trojan.Bestafera.E |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
6d3d79103b38f01bf767bb8aed59532e
SHA1:
d769ae1d782d32e37ab6600ef4daa62f47b774f1
SHA256:
823DFCF4F213509BBFED2CACEF73233B1BD776C3FC1D89E3642125D47AEAC3B9
File Size:
1.34 MB, 1340928 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show 2 more
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- 2+ executable sections
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 4,040 |
|---|---|
| Potentially Malicious Blocks: | 42 |
| Whitelisted Blocks: | 3,978 |
| Unknown Blocks: | 20 |
Visual Map
... Data truncated? - Unknown Block
x - Potentially Malicious Block
