Trojan.Metasploit.Gen.BP
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 5,452 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 38 |
| First Seen: | July 26, 2026 |
| Last Seen: | October 10, 2026 |
| OS(es) Affected: | Windows |
Trojan.Metasploit.Gen.BP is a dangerous Trojan detection that affects Windows computers. It is classified as a high-risk threat, with a danger level that reflects its ability to give attackers deep control over an infected system. Like many threats bearing the "Metasploit" name, it is associated with exploitation frameworks and payload-delivery techniques that security researchers and malicious actors alike use to test or breach system defenses. When found on a legitimate computer rather than a controlled testing environment, its presence should be treated as a serious security incident.
Table of Contents
What Trojan.Metasploit.Gen.BP Does
Once active, Trojan.Metasploit.Gen.BP installs itself quietly and runs in the background without showing any visible windows or alerts, so victims typically have no idea it is operating on their machine. It is designed to perform malicious functions behind the scenes, which can include allowing a remote attacker to gain extensive, and in some cases complete, control over the infected system. Threats in this family are known to disguise themselves using names and file properties that mimic legitimate software components, such as common browser or system utility files, in an attempt to blend in and avoid suspicion. This disguise makes it harder for an average user to notice anything out of place just by glancing at running processes or installed files.
How It Usually Gets Onto Computers
Trojan.Metasploit.Gen.BP commonly spreads by exploiting unpatched system vulnerabilities and security flaws. It is frequently delivered through software downloaded from malicious or compromised websites, as well as through email attachments sent from untrusted or unknown sources. These attachments can be disguised with a variety of extensions, including executable files, image files, and video files, which trick users into opening them without realizing they contain hidden malicious code. In general, Trojans of this kind rely on social engineering and unpatched software to slip past a user's defenses unnoticed.
Risks for the User
The biggest danger of this Trojan is the level of access it can hand over to attackers. If it succeeds in compromising a system, cybercriminals may be able to monitor activity, steal sensitive data, install additional malware, or use the infected computer as a launching point for further attacks. Because it operates silently, the damage can continue for an extended period before a user notices anything wrong, increasing the risk of data theft, financial loss, or long-term system compromise.
Signs of Infection
Trojans in this category are built to avoid detection, so obvious symptoms are often minimal. However, users may notice unexplained slowdowns, unusual network activity, unfamiliar processes or files appearing on the system, security tools being disabled or failing to update, or unexpected changes in system behavior. Any unrecognized files bearing legitimate-sounding names tied to common software components should be treated with caution and investigated further.
How to Stay Protected
To reduce the risk of infection, keep the Windows operating system and all installed software fully updated so known vulnerabilities cannot be exploited. Avoid downloading programs from untrusted or unofficial websites, and never open email attachments from unknown or unexpected senders, regardless of the file extension. Maintaining regular backups of important data, using a standard user account instead of an administrator account for daily tasks, and running a reputable, up-to-date antimalware solution can all help detect and block threats like Trojan.Metasploit.Gen.BP before they cause serious harm.
Analysis Report
General information
| Family Name: | Trojan.Metasploit.Gen.BP |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
6b4f72fdfbfceda1f25c8676cb994e7f
SHA1:
f157961f5e560c48f07465387bc39c4a2ce57553
SHA256:
E19EF48A48EDA8258BE92D5EBC1C02EE6F7FF2339305897CD4C4B828B34CE151
File Size:
872.96 KB, 872960 bytes
|
|
MD5:
57c26ca59c3cd4f7294470a38a742c1e
SHA1:
3a01e55297bb6157b265f1ffd1fc2f7cb72856aa
SHA256:
1F4D39A8CF31F46F597AD1C070291B8CCBCDD406BDA8DBD7ED026679E2085F97
File Size:
1.57 MB, 1574400 bytes
|
|
MD5:
c7f709bcd44b9cae9688034dd2dbbf66
SHA1:
5313f9c6f4a9d5cc9df0bcda456d83ab898db9ab
SHA256:
938C4AC14959939E138DA1A211B228FD2B4C6443C8C7DFD8B8D692A1E5722D34
File Size:
879.62 KB, 879616 bytes
|
|
MD5:
82e917ce35dd084ff1dda6f9cce4c42f
SHA1:
5bd20c3bcd275f9e08a86d9759b3519fc1c2ed8d
SHA256:
8C6921827647E847DC51EA2CECA26D945C9571BF2FD82FA1F7DE84D071427C11
File Size:
879.62 KB, 879616 bytes
|
|
MD5:
28dc755329ac4dc109e3a79fd6359c6f
SHA1:
97738cd5c984d0398eb0986929624a9dd5ea0281
SHA256:
42DF7D1D73BF008BA044DE074B8BC5E06290A55F3537701B9907F5A217F2B3D8
File Size:
872.96 KB, 872960 bytes
|
Show 2 more
|
MD5:
b26aac4387d5d362a9248cc4811bf3eb
SHA1:
5992a4e9392db2ccb7e7d4f48333e3d8cb62c410
SHA256:
4482BCEA03CE795A9F029153CA0E0282BCB6284DF3639D4221C0B0176F823617
File Size:
1.58 MB, 1580032 bytes
|
|
MD5:
0c85831f1eb3c9ff32f2c20575d07da7
SHA1:
3ad1513f299aadd739dde9c6d6ba2291a29660f3
SHA256:
33A42BD8A1EF3BFDEFD47B49BD9F50490625C4629F2D3347DDB5F08F951F4585
File Size:
879.62 KB, 879616 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show 1 more
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright | © 2026 DuckDuckGo |
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- dll
- VirtualAllocExNuma
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 3,794 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 3,739 |
| Unknown Blocks: | 55 |
Visual Map
... Data truncated? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.DFWA
- Aotera.D
- Aotera.G
- Aotera.GA
- Brute.WWB
Show 7 more
- Downloader.MP
- Dropper.Agent.HU
- Kryptik.VEB
- Trojan.Agent.Gen.BCX
- Trojan.Downloader.Gen.ANB
- Trojan.Kryptik.Gen.FLZ
- Trojan.Metasploit.Gen.BP
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n # �v����Bx (�1`1�1HO @V� A��H[uN$b"hk`k�q{b��P� ��!���� � ��3�� ��� ������m� Ù� �V ����$�8წ���l� �&M �~ �=�SB1_ T�Vw���%�������� �AE��D��&��$���L A *�" C ��| | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show 47 more
|
| Anti Debug |
|
