Trojan.Downloader.Agent.AG
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 6,615 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 74 |
| First Seen: | September 15, 2021 |
| Last Seen: | July 14, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Downloader.Agent.AG on your system indicates a potential security threat that requires immediate attention. This type of malware is designed to download and install additional malicious software on your computer, which can lead to a range of problems, including data theft, system crashes, and unauthorized access to your system.
Table of Contents
What Is Trojan.Downloader.Agent.AG?
Trojan.Downloader.Agent.AG is a type of Trojan horse malware that is designed to download and install additional malicious software on your computer. The name "Trojan" refers to the fact that this type of malware disguises itself as a legitimate program or file, allowing it to evade detection and gain access to your system. The "Downloader" part of the name indicates that this malware is capable of downloading additional malicious software from the internet, which can lead to a range of problems.
How Trojan.Downloader.Agent.AG Operates
Trojan.Downloader.Agent.AG operates by exploiting vulnerabilities in your system or tricking you into installing it. Once installed, it can download and install additional malicious software, including other Trojans, spyware, adware, and ransomware. This malware can also modify system settings, disable security software, and create backdoors that allow hackers to access your system remotely. The goal of this malware is to gain unauthorized access to your system and steal sensitive information, such as login credentials, financial data, and personal information.
Symptoms of Infection
The symptoms of a Trojan.Downloader.Agent.AG infection can vary, but common signs include slow system performance, pop-up ads, unwanted programs or toolbars, and unexpected changes to system settings. You may also notice that your system is crashing or freezing frequently, or that your anti-virus software is disabled or unable to update. If you suspect that your system is infected with Trojan.Downloader.Agent.AG, it is essential to take immediate action to remove the malware and prevent further damage.
- Slow system performance
- Pop-up ads
- Unwanted programs or toolbars
- Unexpected changes to system settings
- System crashes or freezes
- Disabled or non-functional anti-virus software
How to Remove Trojan.Downloader.Agent.AG
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow you to download and install removal tools.
- Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove the malware.
- Uninstall any suspicious programs or applications that may be related to the malware.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
- Reboot your system and perform another full scan with your anti-malware tool to ensure that the malware has been completely removed.
Conclusion
Removing Trojan.Downloader.Agent.AG from your system requires careful attention to detail and a thorough understanding of the malware removal process. By following the steps outlined above and using a reputable anti-malware tool, you can effectively remove this malware and prevent further damage to your system. Remember to always be cautious when downloading software or files from the internet, and to keep your anti-virus software up to date to prevent future infections.
Analysis Report
General information
| Family Name: | Trojan.Downloader.Agent.AG |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
278cf09fb1c424c9c29758f90751090b
SHA1:
94f7c7d5590471705068428e766b7b2e82fae90f
File Size:
948.74 KB, 948736 bytes
|
|
MD5:
da867009d2030d87a6614c2a2a085d19
SHA1:
43cf91443837af87d0769f274639dd7d2ee39987
File Size:
4.75 MB, 4752832 bytes
|
|
MD5:
39fae91e8d2886857d6ed1b4f0e65080
SHA1:
18f81a5c822700e180198291d149313b9eecce48
SHA256:
E03CC659CFE024629D01C4E99E375CD191753FBDF751BCDA2FC8E32D9E1AEAF5
File Size:
2.23 MB, 2228224 bytes
|
|
MD5:
3f959b4b33ad648c11efcdff5fb16ea9
SHA1:
c52c004901d05fe65abc7b433340718b5458b744
SHA256:
6F27761C203E13F5295F4DE795F1672631A7EE10DD288894FF6117B58DAE8BDE
File Size:
4.55 MB, 4546560 bytes
|
|
MD5:
abb80f2c3d091c914ebfa3f5421856c1
SHA1:
1566401488fd4431f06cee2089c674bb555d8982
SHA256:
175A72265ECEA39E5C6A42181ACA59A435879AF70C0F248F2243890BF0E07C0C
File Size:
360.96 KB, 360960 bytes
|
Show More
|
MD5:
3db2fdd35f0e3d38941386021f746bd1
SHA1:
cd8b9240e0136c0f1217f7f1b1d3c61f675ad6a9
SHA256:
A751EDE47226609BFD4F704FA34A4B62E9D7230D2A38C17732964E796BA09291
File Size:
2.89 MB, 2889216 bytes
|
|
MD5:
0cff620a2f4232f4fdb2dfabd22c1ce6
SHA1:
6edff7e00ddbb60fef4e3a9859dca9e41db2d27f
SHA256:
832E91B997B4DE2F4EFCF55E1836F9E8E5779BDD601B75E8E6886B7A5A29D704
File Size:
2.25 MB, 2253824 bytes
|
|
MD5:
bdaa1e1f6719ad0724e70bd97ae36b36
SHA1:
303dc2fc26a61a3315f056897f3355ad4fa9edc8
SHA256:
EA988C06DB3FD241C0BB30AFC727BB6DC8DBB38584DDEFD56CF3D1CA7B96DC1E
File Size:
1.74 MB, 1742336 bytes
|
|
MD5:
e99af92d86f15adcf39000a1617b17b5
SHA1:
089fdfd2e153a3eb71d87f9c2ef7ac8aa122af60
SHA256:
54A7318EDD7B69B58C581E6E7D68C0602CCC06CC8D651DD19D269E6D2E9E5593
File Size:
843.26 KB, 843264 bytes
|
|
MD5:
bf66cd39e37630d7dae52b323c82a5c3
SHA1:
dd0a73a9e200b1f4b55446065145c61286d70522
SHA256:
B3E36B89378D11A382FF320C54AFB41DB4E6209452A4C8635F036DA1A79AFBA6
File Size:
2.22 MB, 2224128 bytes
|
|
MD5:
90b25a7465902d8f902be52c9fd33563
SHA1:
60c7341f9054c1af844286f6d9ae1cda2847713e
SHA256:
CD46AFEB8D1898D496D47E2BD3144933C0E97E871FBE5420B57B6A41C1C3240D
File Size:
9.14 MB, 9139712 bytes
|
|
MD5:
83c7651e8764bf189b55c37e679f46f7
SHA1:
3f99c4381bba0539053b158331d9703e4af3be8d
SHA256:
DA2B26C0CC4459399C520797809B12DBD54C85A4423E3AFB3AD7CE23B5831429
File Size:
3.70 MB, 3702784 bytes
|
|
MD5:
791581c2528339ece44e5baa34617dce
SHA1:
a0a51e8fa62ef4cf7e667bc133c063cd71c25a56
SHA256:
0C037128F669DF5E0C4B321994AB900208450B027A14F3FD0AFEF142ED80C7C9
File Size:
4.14 MB, 4135424 bytes
|
|
MD5:
a3ae2af5ff39d88034856be389578414
SHA1:
fee1525c562fed9815083ab92cd46fa341b45a63
SHA256:
E0E0B538DABB35627413FFBDE36408E43E3E7823510F2E6EBC083ABCFEE28CEF
File Size:
3.95 MB, 3949568 bytes
|
|
MD5:
cf7047066ccceb32f687f1a91cd4a4cf
SHA1:
d8e00f7a4bd7a768df09c5b2d9965f6e919fab08
SHA256:
D2525ECE6856E69DCC8A4A56CC01181011E2294D973BE2FB2D068F20C3AEA374
File Size:
36.35 KB, 36352 bytes
|
|
MD5:
96d148b916b709311fbcf66f9541ca22
SHA1:
7584771fd4e90466936ce52790441afcc06b1f4c
SHA256:
9FBC872C9FB4C642DB48D623B153730DABDC26961A7D2DDAC7011238CCD54868
File Size:
1.90 MB, 1903104 bytes
|
|
MD5:
cb2dba006f3d1ef3b8439d3174637244
SHA1:
0f092030400de64a5fdf155523a7f2aae7a024f6
SHA256:
FC4E536F0C783FEDD1C739A2DE8D53C7C9CD359C9A6D870FDED71318F1F53046
File Size:
1.70 MB, 1702400 bytes
|
|
MD5:
c702e49f3c6494347a477aa23d6e7e0e
SHA1:
e0b6a35871cf0e1a736fcfed3d9de91c1fb59ba2
SHA256:
DA841538EDF6647BD7D3668B84278FD3FD8E1A0E412A0D7265B21CE5F7275258
File Size:
1.75 MB, 1745408 bytes
|
|
MD5:
8460a0a919cad887298fc4e64e44194c
SHA1:
3664bba6cb994f0414444c2cc197c7c52f929182
SHA256:
EB3D40B4EF567596362E13994E86555E96E10C7E627C4D1761D1F1B602A2CAD8
File Size:
516.10 KB, 516096 bytes
|
|
MD5:
cf7404bdaecc30535fe296490171aa44
SHA1:
ba847d84e1d9b68e1b4f55151733a8951175edbb
SHA256:
0800FE95A9267B88BBE158B322E87FC2267ABC95F1C4E1BD2798A867329BCE62
File Size:
4.41 MB, 4414976 bytes
|
|
MD5:
d4a8b7a360efc216769f9cf8acead748
SHA1:
ccb8f899d0a26222215975d5311b45dd0a2941b5
SHA256:
9B691E998928BDDE86F1A00DF878A3176C3D12AC85C2F3BFA2722287A9C51CB2
File Size:
6.74 MB, 6736384 bytes
|
|
MD5:
dd0b41a732cf5e478b138102305e9a2e
SHA1:
91b319da35acd467a7a8edd06f23f2bd0e78c73f
SHA256:
52BF0BD3DB4B8FED749D9DF21A55CB646EE09FFF56B0CD6C06845026445E05C2
File Size:
751.62 KB, 751616 bytes
|
|
MD5:
5fa65d90d6bda77bc56bdc0291cbc190
SHA1:
e81e3176aa6aec8550ecdcadab2b0057cb9f49c7
SHA256:
47279D2B4B80985FB981C5097F11BE6252FEBC143E8336229016AED5EB7FDC78
File Size:
750.59 KB, 750592 bytes
|
|
MD5:
38ac7091a5db84afddd55ac5f2a18c32
SHA1:
a04a722a2cdc4a53db3e51fa56f8499ee5289a48
SHA256:
1F55872FBF36B20CAF04CB02694E072D56CF2952D599CB8125C563AC457530CF
File Size:
1.72 MB, 1718784 bytes
|
|
MD5:
7a7b63bf4d381d0106de22dd10a18c49
SHA1:
7fb7c0d18812107c27a19f5cee48a876acadb455
SHA256:
FEF9A0589C954A5D7716E64A4AF5915EB2495E7788ABC33D8CD203FB64736D88
File Size:
977.92 KB, 977920 bytes
|
|
MD5:
28f42b6e078b0c7d7f30133f82899d3c
SHA1:
fa0b9c39eed1bed8931fa8ee188ff4a0ce6c66ce
SHA256:
97C43E6D159FFDD1A15C8661296B7A3B3E669415A818368A1376B866847B50E7
File Size:
1.18 MB, 1176064 bytes
|
|
MD5:
1d455f91814fee4d4d6c94da118ae90a
SHA1:
7ee80660d234bb563a917e4ab58eb9d5bcefc357
SHA256:
17361FEDC3176157433F731E07C17A6AFA763B5A567A4F4643983F20A10D3EC3
File Size:
749.06 KB, 749056 bytes
|
|
MD5:
9f0c80eda797a81162e154c4cb40a784
SHA1:
ebb39b7e761d9d3c361c6f8b9281b11e6524e4ec
SHA256:
784A717B5FF84227A778BA800A6E9F275295CBE0C911E62443C73843B2BAFA77
File Size:
3.32 MB, 3316736 bytes
|
|
MD5:
01254e18b20b7fc8a262bb8d130c573f
SHA1:
ce74d4a169fd47135f2ed67bfce88d28f6747245
SHA256:
6A1BB934E3E43BBE4D6F0DAB694E18FAB9BDAC28F8354643AC9C05A2098290AE
File Size:
5.35 MB, 5350400 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
Show More
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments |
|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
|
| Internal Name |
Show More
|
| Legal Copyright |
|
| Legal Trademarks |
|
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
|
File Traits
- .NET
- Agile.net
- CreateThread
- dll
- Fody
- HighEntropy
- ntdll
- Pastebin
- VirtualQueryEx
- WriteProcessMemory
Show More
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 868 |
|---|---|
| Potentially Malicious Blocks: | 49 |
| Whitelisted Blocks: | 353 |
| Unknown Blocks: | 466 |
Visual Map
0
0
0
0
?
?
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
?
?
?
?
?
?
0
0
0
x
0
x
x
0
x
x
x
0
0
?
0
0
?
?
0
?
0
0
?
?
?
?
?
0
?
?
?
?
?
?
?
?
0
?
?
?
0
?
?
0
0
?
0
0
0
?
0
0
0
0
0
0
0
0
?
?
?
?
0
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
?
x
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
x
x
?
?
?
?
?
?
?
0
?
?
?
0
?
?
0
?
?
?
?
?
?
?
x
?
?
0
0
0
0
0
?
?
?
?
?
0
0
0
0
x
?
0
?
?
?
?
?
0
0
?
?
0
0
?
0
0
0
0
x
?
0
?
?
?
0
0
?
0
?
?
0
0
?
?
?
?
?
?
0
0
?
0
?
0
?
?
?
0
?
?
?
0
?
0
x
x
?
0
0
?
0
?
?
?
?
?
?
?
?
0
0
0
?
0
?
0
?
?
?
?
0
0
?
0
0
?
0
?
x
x
?
?
?
?
?
0
?
0
0
?
0
?
x
?
?
?
0
?
?
?
?
?
?
0
0
0
0
?
?
?
?
?
0
0
0
0
0
?
?
?
?
0
0
x
?
?
?
?
?
?
0
0
0
0
?
0
0
?
0
0
0
0
0
?
0
?
0
0
?
0
0
?
0
?
?
?
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
0
?
?
?
?
0
0
?
0
?
0
0
?
?
?
?
?
0
0
?
0
0
0
0
?
0
?
?
?
?
?
?
0
?
0
?
?
?
0
?
?
0
x
?
0
0
0
?
?
?
0
0
0
?
?
?
?
0
0
?
?
?
?
?
?
0
0
0
0
?
0
0
0
0
0
0
0
?
?
?
?
?
?
?
0
0
0
0
?
0
0
?
0
0
?
?
0
0
0
?
?
?
?
?
?
?
?
?
?
x
?
?
x
0
0
?
?
?
?
?
0
?
0
?
?
?
0
?
0
?
x
0
?
?
0
?
?
?
?
?
?
?
?
?
x
0
?
?
0
0
?
0
?
?
?
0
?
?
0
?
0
?
0
?
0
0
0
?
?
?
?
0
0
?
?
?
0
0
?
?
0
0
0
0
?
?
?
0
?
0
?
0
0
0
?
?
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
0
?
0
?
0
?
0
?
0
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
0
0
?
0
?
?
?
0
?
0
0
0
0
0
0
0
0
0
0
?
0
0
?
0
0
x
?
?
0
?
?
?
0
?
?
?
?
?
0
?
0
?
0
?
0
?
0
?
0
0
0
?
0
?
0
?
0
?
0
?
0
0
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
0
0
?
0
0
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
0
?
?
0
?
0
?
0
?
0
?
?
0
?
0
0
0
0
?
0
?
0
?
0
?
0
?
0
0
?
0
?
?
?
0
?
0
?
0
?
0
?
0
0
?
?
?
?
?
?
?
?
?
0
?
0
?
0
?
0
0
?
0
?
0
?
0
?
0
0
0
0
?
0
?
0
?
0
?
?
0
0
0
?
?
0
?
0
0
?
0
?
0
?
0
?
0
?
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Downloader.Agent.AG
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\downloads\panel dll - external.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\downloads\scripts\komorebi.lua | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\valex::workspacefolder | c:\\users\\user\\downloads\\workspace | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\tracing::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey |
Show More
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | .k 8��8tXz��B�8 �� �6 �v z 5� �Z xy �� T�B� ������ � ���� �5����ee +��Bx �< 5 � �!wz "Wc#�#��$kF$�� %"�%:� %�&� &�x(�(X�)�`*J*9*�"*�^*�h+�[,��/9� /��0P%1` | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| User Data Access |
|
| Anti Debug |
|
| Syscall Use |
Show More
70 additional items are not displayed above. |
| Encryption Used |
|
| Other Suspicious |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Network Info Queried |
|
| Process Manipulation Evasion |
|
