Trojan.MSIL.Stealer
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,655 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 43,489 |
| First Seen: | January 12, 2022 |
| Last Seen: | August 1, 2026 |
| OS(es) Affected: | Windows |
A threat has been detected on your system, identified as Trojan.MSIL.Stealer. This detection indicates that your computer may be infected with a type of malicious software designed to steal sensitive information. It is essential to take immediate action to remove the threat and prevent further damage.
Table of Contents
What Is Trojan.MSIL.Stealer?
Trojan.MSIL.Stealer is a type of Trojan horse malware that is designed to steal sensitive information from infected computers. The name "Trojan.MSIL" suggests that the malware is written in Microsoft Intermediate Language (MSIL), which is a platform-agnostic intermediate representation of code. The ".Stealer" part of the name indicates that the malware is designed to steal sensitive information, such as login credentials, financial information, or personal data.
How Trojan.MSIL.Stealer Operates
Trojan.MSIL.Stealer, like other types of malware, can operate in various ways to achieve its goals. It may use social engineering tactics to trick users into installing the malware, or it may exploit vulnerabilities in software or operating systems to gain unauthorized access to the system. Once installed, the malware can communicate with its command and control servers to receive instructions and transmit stolen data. It may also use encryption or other techniques to evade detection and hide its activities from the user and security software.
Symptoms of Infection
Systems infected with Trojan.MSIL.Stealer may exhibit various symptoms, including slow system performance, unexpected crashes, or unusual network activity. Users may also notice that their personal data is being stolen or that their online accounts are being accessed without their permission. In some cases, the malware may not exhibit any noticeable symptoms, making it difficult to detect without the use of specialized security software.
- Unexplained changes to system settings or files
- Unusual network activity or connections to unknown servers
- Slow system performance or crashes
- Stolen personal data or unauthorized access to online accounts
How to Remove Trojan.MSIL.Stealer
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for easier removal.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect and remove the malware.
- Uninstall any suspicious programs or applications that may be related to the malware.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or settings.
- Reboot your system and perform another scan with your anti-malware tool to ensure that the malware has been completely removed.
Conclusion
Removing Trojan.MSIL.Stealer from your system requires careful attention to detail and the use of specialized security software. By following the steps outlined above, you can help to ensure that the malware is completely removed and that your system is protected from future infections. It is also essential to take steps to prevent future infections, such as keeping your operating system and software up to date, using strong passwords, and being cautious when clicking on links or downloading attachments from unknown sources.
Analysis Report
General information
| Family Name: | Trojan.MSIL.Stealer |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
5731c778eb89c4bf53ed3ab0303df80b
SHA1:
322041a280019a369e562888c4579bee1792233c
File Size:
5.32 MB, 5320192 bytes
|
|
MD5:
b980f0a52d3dfae79496c9d6226a3447
SHA1:
c31cdf5bfbf03149aed83484aba3f9575f783c81
File Size:
1.87 MB, 1874944 bytes
|
|
MD5:
0cbca520a15d42bc859d77e7cc7c6b26
SHA1:
4ab1d57cbad77a30554dc209d21da32cfa336beb
File Size:
13.82 KB, 13824 bytes
|
|
MD5:
fcc0390053b6b4ae749c50fbde9652b4
SHA1:
ec79c0eae26062cc049cc8053b31f8c5445afc8e
File Size:
2.11 MB, 2110976 bytes
|
|
MD5:
2bb62a5067f6287850034cf9a79feae1
SHA1:
1b114d22d0860a09a8b48d825da1b92ab84b0fca
SHA256:
43C2F4B7A1E04544C66F256731A0BFA18BEB427C8C19DEDF43D7063A09910AF9
File Size:
2.08 MB, 2080256 bytes
|
Show More
|
MD5:
f886ea8e6db06d490258830ddc4bfd00
SHA1:
7984d96c61cea6d0626470884ff48aafeccf5596
SHA256:
97F8DE23046C20924C77AAB7332FE11793C6DE4DA7DCCA3CFB0B71063F185892
File Size:
989.18 KB, 989184 bytes
|
|
MD5:
73debc2cf96533f665ecca1eb9e31148
SHA1:
9fd3c0d7d5d8cfaf784dd36b79777d7eef5fd2bf
SHA256:
DD8174CEC55736A539BCB2154CBE6E8991C71277E0C800FF4DC533C8832479F2
File Size:
6.03 MB, 6031597 bytes
|
|
MD5:
56a91b2cc1599725a71d9c9990ff5c1b
SHA1:
949b8779b1b40a7063758007293feb1c2b585562
SHA256:
B5EEAC3CCE17366E6A9946690842776645942F83B773FB7619E979D0D21AC03E
File Size:
2.28 MB, 2283520 bytes
|
|
MD5:
acfaccf392ece6b4042790a8de85a86e
SHA1:
d12f07e82c1927b22ee3d4f2a1f5b59478944163
SHA256:
1E9FCD3DF0E86145D3EF878D875766C98E6012FD51725E2EBC61C38AA7544FD1
File Size:
307.71 KB, 307712 bytes
|
|
MD5:
5b85cce77ed306beb39436316c7c4e66
SHA1:
12b9b03bf1b98f8feef8fb26bdd58c8ee62b29d4
SHA256:
D47B8EBAEF68C975426F339AF9C7F17F9F1399C881416268E823B44AA155C7D0
File Size:
2.28 MB, 2283520 bytes
|
|
MD5:
29b8883e46107efe95d039306bdb963c
SHA1:
75848fb9c6f3a808bb32216675472d5d9d8012b4
SHA256:
7E5C269AC46943FE93BE8C14D5E2B82DB5AEF24C75A9885C19A083D54BA9FB36
File Size:
2.05 MB, 2049024 bytes
|
|
MD5:
aaece4bfe9aef86a5af44fd1bd5d7b1b
SHA1:
d63a4a7e3b68e232a45e5e6de6e3278063c5b050
SHA256:
2DB6938351D75FA88670ED1A48C27AAF326D4335DBDC966C7D03DFE630572DF6
File Size:
7.68 KB, 7680 bytes
|
|
MD5:
37cd04645f0933648932f0a1a8a3bdc6
SHA1:
dc9d02258f9b6cb34e306216a01d4d9d284ed7ef
SHA256:
E0F7DF187494CFF70D35543210B3619327A59329DFFD1D141D922F8FB67F335C
File Size:
69.12 KB, 69120 bytes
|
|
MD5:
d57dff6b0d167730e55f8c9017299529
SHA1:
5158aa0e8aff8454f59c23f2bb69c76dcfa76ff2
SHA256:
0327AF3297329BA26A48A62C95CB80741A8A9F90A4C4B63392A9B23BB25150D1
File Size:
7.37 MB, 7372288 bytes
|
|
MD5:
189a8ff62489550755957a9bfe48e4c9
SHA1:
08821ea50dae42c62153ba653d413ad8c4c47482
SHA256:
1AC4976B5553ADDFA29F18FE3AE545378640F6ED20A4DB9513479EDFC2A910F3
File Size:
34.30 KB, 34304 bytes
|
|
MD5:
5792c32729aec7031b6eb57565ab79f1
SHA1:
7fb5b21fef89ea58d76c3f3f40083b34fde587ea
SHA256:
8E706ACA7BFA8A796F21AE00BF1EE3F7055F1CB6D68B9AEC6331404CCBBCD9D6
File Size:
2.32 MB, 2323456 bytes
|
|
MD5:
2c817d8cd4ad49ebb75adfd1857a8afd
SHA1:
9f02d54c905b1eda460672e216e72c0d8da03b82
SHA256:
455E79472B0EC2D974ECBAD86E44FB95F8F7A1BEEDE0C5916220DF40AFBFD0EB
File Size:
4.46 MB, 4462896 bytes
|
|
MD5:
bb0e1e191c80dc9c60e3a27a1a154279
SHA1:
1e652b15781abc6125f9109b46e9a979142c6734
SHA256:
DC3E8684167715BE985553F532625715ED209ED24B12FCC5BF8494518FD47CA1
File Size:
2.28 MB, 2284032 bytes
|
|
MD5:
b975ec36b07038f5d19777af00370aaf
SHA1:
9501f492481ceecf41f4f5ac2d9b536e2207a394
SHA256:
03F1C0DE207E27B45C8A2BB0A77E0895AB98A7271FA3AF11B86BE22BFA9BF9F0
File Size:
202.75 KB, 202752 bytes
|
|
MD5:
cfc700ea7d40b38c93f6901ba1495e0c
SHA1:
9504015a7101579c99c7e05d7fb6c1bfafdf5276
SHA256:
D2166793421F640CC1B0819C727C1655C441DA0D98461E6B773121C5FE8F060F
File Size:
204.29 KB, 204288 bytes
|
|
MD5:
dc87dc00270ce8dbbaaa5e75100595d8
SHA1:
6a70c9266f4a1e8d6d27f66be5254225d8f9b499
SHA256:
5795B085BD9C00A721369763538FD7987683967250D5B4720596DC31D51A34E0
File Size:
116.74 KB, 116736 bytes
|
|
MD5:
838703d503b5c20e07412c080c1dfc62
SHA1:
bc5664cf6ebcbd3032c183a89f70abdf056573f3
SHA256:
599F8044AC833677564223F34B28FC9286C40683095485BA366EC465ACCDFA74
File Size:
307.71 KB, 307712 bytes
|
|
MD5:
5ec30d636925a9ddf5eb80127c23074f
SHA1:
2b937a3496e47e2ebcd480db02f1322319487ea0
SHA256:
049A2A222F0F29A4BA9348CC446F866140258A1436DC3307B72DF350E16574CD
File Size:
525.82 KB, 525824 bytes
|
|
MD5:
74c0a5ba3ece3c0fc5815de970769644
SHA1:
0b7585e2b00c13b1c0993be0b99798a5fe48b966
SHA256:
69B01763BC576C39BADDC308FA5DF09F32502F5AB073ECB1A29EAB5872D4BD83
File Size:
1.34 MB, 1339904 bytes
|
|
MD5:
d0189c2256a42ed68d96b70f5ab6009c
SHA1:
f375ac061964b17464ea9313682e0769a79597b6
SHA256:
FE8AC6C07EA3E770E4EB272A0D3C87E89B3D6BCF83254DC88C82301C0C89298C
File Size:
261.63 KB, 261632 bytes
|
|
MD5:
fc80da6fac6d35bea5d9fe676acca41a
SHA1:
17bde51184e484f3c3e7444f051bee780e934282
SHA256:
FE1E3F38E6BD2EC3CFCACC946A22C8D8212F083C8165CB3CAA9AE301C25332FF
File Size:
831.49 KB, 831488 bytes
|
|
MD5:
dfd415c2bcde7d59533738e20c419e78
SHA1:
8c52510574f56ffb4d33c964d725bf7c48ab0830
SHA256:
551082B1AD164CA23507D705E1CF4ACA3FB9604E5F0FD923961022CE964609D5
File Size:
154.62 KB, 154624 bytes
|
|
MD5:
24c60dcb1f191e154da80ed03778140a
SHA1:
becf246ae878ffbd025374d3c283ea28645f84dd
SHA256:
76C174C48F149EC8EB42B19D7E62DDAB6057604B3EC0FA8B292946570A6D6B04
File Size:
4.77 MB, 4768141 bytes
|
|
MD5:
02ca9583237646ba46c8699ff8ee6ff0
SHA1:
02572cbf8264c437758d834c0aa5409b941aa353
SHA256:
A06CA2F848C977BA268366038CFBE8F696C0E25424001FF9CFF2271C5A16A258
File Size:
2.93 MB, 2928640 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
Show More
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
Show More
|
| Comments |
|
| Company Name |
Show More
|
| Compiled Script | AutoIt v3 Script: 3, 3, 8, 1 |
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Legal Trademarks | 泽商顾 太首顾太司希城行席 |
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
Show More
|
File Traits
- .NET
- .sdata
- Agile.net
- CryptUnprotectData
- Fody
- HighEntropy
- NewLateBinding
- No CryptProtectData
- ntdll
- RijndaelManaged
Show More
- Run
- WriteProcessMemory
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,398 |
|---|---|
| Potentially Malicious Blocks: | 489 |
| Whitelisted Blocks: | 508 |
| Unknown Blocks: | 401 |
Visual Map
0
0
0
0
0
0
x
0
x
0
0
0
0
x
?
?
x
x
?
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
x
x
0
x
?
?
0
x
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
x
0
0
?
0
0
0
0
?
0
0
0
x
0
0
0
0
0
0
0
0
x
x
0
?
0
0
0
0
0
0
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
?
0
0
0
0
0
0
0
0
0
x
x
0
0
0
?
0
?
0
0
0
0
?
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
x
0
x
0
0
0
0
0
0
0
x
?
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
x
0
0
0
x
0
0
0
?
x
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
?
0
0
0
x
0
0
0
x
x
0
x
0
0
0
0
0
x
0
0
0
0
0
0
x
0
?
?
?
x
x
?
x
0
0
x
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
x
?
0
0
0
x
0
0
0
x
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
x
x
0
0
0
?
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
?
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
?
?
x
0
0
0
x
0
?
x
x
x
x
x
x
?
x
?
x
x
0
?
x
0
0
x
0
?
x
x
x
?
x
x
?
?
?
?
x
x
0
?
x
?
x
?
?
x
x
?
x
?
?
?
x
x
?
?
?
?
x
?
x
x
x
x
x
?
?
?
?
x
?
?
?
?
?
?
?
?
x
?
x
x
?
x
x
x
x
x
?
x
x
0
x
0
0
x
x
?
?
x
x
x
?
x
?
x
?
0
?
?
x
x
?
?
?
?
x
x
?
?
?
?
x
x
x
?
?
?
x
?
?
x
x
?
?
?
x
x
x
x
x
?
x
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
x
x
x
?
x
0
?
x
?
?
?
?
x
?
x
?
x
?
x
?
x
x
x
0
x
x
x
?
x
?
?
x
0
x
x
?
x
x
x
x
?
x
x
x
x
?
?
x
?
?
?
x
x
x
x
x
0
0
x
?
?
?
?
x
?
x
x
?
?
?
x
x
?
x
?
x
?
?
x
x
x
0
0
0
0
x
x
x
?
0
0
x
?
?
x
0
x
x
0
?
0
?
x
?
0
?
0
x
?
?
0
?
?
0
x
x
x
x
?
?
x
x
x
?
?
?
?
x
?
0
x
0
x
?
0
x
0
0
?
x
?
x
?
x
x
?
x
?
x
?
x
x
x
x
x
?
0
0
?
0
x
x
?
x
x
?
?
0
?
?
?
?
?
x
?
0
0
?
x
0
?
?
x
0
x
x
?
0
x
?
x
x
?
?
?
?
?
x
?
x
?
?
?
?
?
?
?
?
0
?
x
?
?
?
?
?
x
?
?
x
x
?
?
?
x
?
x
x
0
0
?
x
x
x
x
x
?
?
?
x
?
x
x
x
?
?
?
x
x
x
x
x
?
x
x
x
x
x
0
0
0
x
0
x
x
x
0
?
x
x
?
0
0
0
?
x
?
0
x
0
x
x
?
x
x
x
0
x
x
x
?
x
x
?
?
x
x
?
x
?
x
x
?
?
x
?
?
0
0
0
0
0
0
?
?
x
?
?
0
x
?
?
?
x
?
x
x
x
x
?
x
x
?
0
x
0
?
x
?
x
x
x
0
x
?
0
x
x
x
?
x
x
0
0
0
0
0
0
0
0
0
0
x
0
x
x
x
?
x
x
?
?
?
x
x
?
x
?
x
x
?
x
x
x
x
?
x
?
?
?
?
?
?
?
?
?
?
?
x
0
x
0
x
x
x
0
x
x
0
?
?
x
x
x
x
x
?
0
x
0
?
0
0
?
?
0
?
x
?
?
?
?
?
?
?
x
x
x
?
?
?
0
0
0
x
?
x
x
x
x
0
?
?
x
?
x
?
?
x
?
?
x
?
x
?
?
?
x
x
x
x
x
?
?
?
?
x
x
?
?
x
x
x
?
x
x
x
?
x
?
x
x
?
?
x
?
?
x
x
?
x
?
?
?
x
?
?
x
x
x
?
?
x
x
?
x
x
x
x
?
x
x
?
?
?
x
x
?
x
?
?
0
?
x
?
x
x
?
x
?
x
?
x
?
?
?
?
x
x
x
x
?
?
?
x
?
x
?
?
x
?
x
x
x
x
?
?
x
x
x
?
?
x
?
x
x
x
x
?
x
x
x
x
x
x
x
?
?
x
?
x
?
?
?
x
?
x
?
x
x
?
x
x
?
x
x
?
?
x
x
x
?
x
?
x
x
?
?
x
?
x
x
x
x
x
x
?
x
x
?
x
x
?
?
x
x
x
x
?
x
?
?
x
?
x
?
?
x
x
x
x
x
x
?
x
x
?
x
?
x
?
x
x
0
?
?
x
?
x
?
x
?
?
?
x
?
x
?
x
?
x
?
x
?
x
?
x
?
?
x
x
?
x
?
x
x
?
x
?
?
?
?
?
?
x
?
?
x
x
x
?
?
x
?
x
x
?
x
?
?
x
x
?
?
?
x
x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Autoit
- MSIL.Agent.XGA
- MSIL.BadJoke.XJ
- MSIL.Coinminer.XB
- MSIL.Gamehack.RB
Show More
- MSIL.HackAgent.CD
- MSIL.Krypt.EEAB
- MSIL.Krypt.VSD
- MSIL.Krypt.VSF
- MSIL.PSW.Agent.GB
- MSIL.Stealer.RAR
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| \device\namedpipe\dav rpc service | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| \device\namedpipe\pshost.134170763569777854.5376.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\wkssvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\drivers\warsaw_pm.sys | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\838a13086b8943afa2c13fbe3a44b08c\exec.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\838a13086b8943afa2c13fbe3a44b08c\payload_package.dat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_1h1s0kx2.ady.ps1 | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\__psscriptpolicytest_4l4z4ems.0vs.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\aut301f.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\aut33d9.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\costura\05a92ec28edc5561548638caa951f864\64\sqlite.interop.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ex_44261.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\hqmork.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\hqmork.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\uqdert.cmd | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\uqdert.cmd | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\dllhost.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\actualizaciones.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\downloads\8c52510574f56ffb4d33c964d725bf7c48ab0830_0000154624 | Synchronize,Write Attributes |
| c:\users\user\downloads\people.csv | Generic Write,Read Attributes |
| c:\windows\appcompat\programs\amcache.hve | Read Data,Read Control,Write Data |
| c:\windows\appcompat\programs\amcache.hve | Write Attributes |
| c:\windows\syswow64\windows services | Synchronize,Write Attributes |
| c:\windows\syswow64\windows services\win32.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\windows\syswow64\windows services\win32.exe | Synchronize,Write Attributes |
| desktop-dlos3m3*\mailslot\net\netlogon | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKCU::di | ! | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 핿㷔ꮙǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | ,k � 8��8tX��B�8 �6 �v 5� �Z xy �� T�B� ������ � ���� �5����ee��Bx �< �!wz "Wc#�#��$kF$�� %"�%:� %�&� &�-&�x(�(X�)�`*J*9*�^*�h+�[,��/9� /��0P%1`1�1HO 1�D5�05�G6�^ | RegNtPreCreateKey |
| HKLM\system\software\microsoft\tip\aggregateresults::data | 隞̃봁耀꧌ Ť ' | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ᙅ朑ᾖǝ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 杇ᾖǝ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 柃ᾖǝ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 큇柮ᾖǝ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\vb and vba program settings\microsoft\sysinternals::procid | s | RegNtPreCreateKey |
| HKCU\software\vb and vba program settings\microsoft\sysinternals::9481 | c:\users\user\downloads\8c52510574f56ffb4d33c964d725bf7c48ab0830_0000154624 | RegNtPreCreateKey |
| HKCU\software\microsoft\windows nt\currentversion\winlogon::shell | explorer.exe,"c:\users\user\downloads\8c52510574f56ffb4d33c964d725bf7c48ab0830_0000154624" | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer\advanced::showsuperhidden | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\image file execution options\win32.exe::disableexceptionchainvalidation | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows script host\settings::reg_dword | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\schedule::start | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows nt\currentversion\systemrestore::disablesr | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ︗궆῝ǝ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | p� * � /�� Y� d� � � �ރ �p ��^ �o � C Vs} kP~ ��1 �� 7 � �� ﺃ e e�� ��1 ( �� f e�� i U e�� r G � s e�� | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
31 additional items are not displayed above. |
| User Data Access |
|
| Other Suspicious |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Network Info Queried |
|
| Encryption Used |
|
| Anti Debug |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Keyboard Access |
|
| Process Terminate |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\\dw20.exe dw20.exe -x -s 824
|
"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -File "C:\Users\Apjshkwp\AppData\Local\Temp\ex_44261.ps1"
|
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\\dw20.exe dw20.exe -x -s 860
|
"sc.exe" stop Warsaw_PM
|
"sc.exe" delete Warsaw_PM
|
Show More
"sc.exe" create Warsaw_PM binPath= "C:\Drivers\Warsaw_PM.sys" type= kernel start= demand
|
"sc.exe" start Warsaw_PM
|
(NULL) C:\WINDOWS\system32\Windows Services\win32.exe
|
C:\Users\Ixbnmfcv\AppData\Local\Temp/HQMORK.exe
|
C:\Users\Ixbnmfcv\AppData\Local\Temp/UQDERT.cmd
|
C:\WINDOWS\system32\fltMC.exe fltmc
|
WriteConsole:
|
WriteConsole: - Inspire Art A
|
C:\WINDOWS\system32\timeout.exe timeout /nobreak 7
|
"C:\Users\Nposhikj\AppData\Local\Temp\838a13086b8943afa2c13fbe3a44b08c\exec.exe"
|
