Threat Database Trojans Trojan.Rugmi.MY

Trojan.Rugmi.MY

By CagedTech in Trojans

Threat Scorecard

Popularity Rank: 839
Threat Level: 80 % (High)
Infected Computers: 311
First Seen: July 11, 2026
Last Seen: September 17, 2026
OS(es) Affected: Windows

Analysis Report

General information

Family Name: Trojan.Rugmi.MY
Signature status: No Signature

Known Samples

MD5: e6ceb3e5fc711b235fd34cc3e27f5f78
SHA1: c66998ed5b5ffe5aadfb2e59def9ca9a81dcd93f
SHA256: 1B09DA19C1979519105999B650C83DED584246216CA276FD627DB6CD66C9DCCA
File Size: 3.75 MB, 3745792 bytes
MD5: 5e7d85b749baf3fbfbdcd8c9b193f03b
SHA1: 3f1b9e36c52c6ed520b781fdf9730aaa7936b75a
SHA256: 18224BDF7C678B8E9C89111F639C6859A6E8C6CE029F6DB8F30E211402EA26A2
File Size: 1.29 MB, 1289216 bytes
MD5: 25e7ac0da34411eeb244f1925516acfc
SHA1: f33175ff326eacf6ec31c8c08a359deaccdf1b63
SHA256: 04DDBA74153A35237A99012C661D3C3B412E59D94137198366154D1C765A49BC
File Size: 1.03 MB, 1032936 bytes
MD5: f84aaca6c136df6f5d2e117f59fca470
SHA1: 2f0ebdd14c23c173680c262c6cdfa0ea2a850f76
SHA256: F409E50C983D74C2EDE0C00D5748DC5C6D086D0CB45995E68141C9154CBD1C5D
File Size: 1.81 MB, 1805824 bytes
MD5: 8bb55279e3493c7560345e723c8033c8
SHA1: 669cc7f735f6cb2bbbcedc7098ceafd813662c06
SHA256: 989BE1221DB8CB079D5F7C1F3B130E2E1B726619634976C611D741AAACE078CC
File Size: 2.42 MB, 2417832 bytes
Show More
MD5: 2208c24bdb4b5cc66cd65f05eaebe532
SHA1: 3f0889b7932befdafa444c6379ee1b7b1c6e826e
SHA256: 1D52DA2D4D05240BC365D318503E23EF7D3601809F86EBA7EAD7CCAE4E27FFF5
File Size: 1.57 MB, 1565848 bytes
MD5: a1fcc9c2e4c207aec779222992e378d1
SHA1: 69912c04143b9a764a447b0e3921e3c348fdbf62
SHA256: EF50090E566A81E73CA85814CF49E10A53671EB264865A533BF48CAD04950819
File Size: 951.30 KB, 951296 bytes
MD5: dfcdbf07b351826290cbe3168d1278d9
SHA1: f93e47be37cc1d0f1bb9af72a965009c6826725e
SHA256: 72FF278EBC8ED26DDD6A2A0D8428637AEE26D6C05482FA8F6762053507415B63
File Size: 7.03 MB, 7027576 bytes
MD5: a0c38e99aedfca1a2bf2e2dc543c3284
SHA1: e4fc4956c5817546de3de22b2e1d71bc9b99b913
SHA256: 1F0E5FB35E259C8289CA7657E461F02930DE30C72B017B67633B8FB84C616A8D
File Size: 103.93 KB, 103928 bytes
MD5: a7f9c5f958540389fbf516a468c88a04
SHA1: 856925784279092a79729f2639252cf2effd0491
SHA256: 7CC50843A1044CE34012984963CE95916E909D7E2924BDE01436C4E380E31425
File Size: 4.43 MB, 4425880 bytes
MD5: 2d2b05cac7acc475550b9501862a2a00
SHA1: 679e14bd529c9fad7da897189cdcc2355a04b1cc
SHA256: CFDEA526C1945AECA3A816B72E4649136D5FC04CC2CA9F80C899DE40978291C2
File Size: 821.76 KB, 821760 bytes
MD5: ef42985de9182f1fd242e19dd33ff023
SHA1: e99e07a6446af3a6e0b9a19199665dd9fd2a9eea
SHA256: D473B9C5ADE6978604D6884611BE96722E0B30661927D2386DD8AEAFF249F2CC
File Size: 5.44 MB, 5435936 bytes
MD5: 6c3df384ffb697b9884f27fddacdad97
SHA1: e6b0a0fe97ad9329dbd0528fe6f516328e1715d1
SHA256: 5969F80EBD0F859A64B0596C6540D1E8ED1A563A5813B31D5D7E85EA4661657E
File Size: 372.74 KB, 372736 bytes
MD5: b53eb48e87f4a0849655f6cd4be97153
SHA1: 7e594f22019af05726a6ea67d63cbf7487a6b692
SHA256: 81A092CA353CA42F0FD4293A8F5A75FFD1E73036DC91455390AE4DD470EC1251
File Size: 170.50 KB, 170496 bytes
MD5: feca77d90fc52072335fa0e82a31d4a1
SHA1: e8a1e4dce282be88536a2d2f3bf1711a8889b637
SHA256: FF749B0ED7BFD780039F614E2C9AABBAE6FF5B4038507A60745C8363825B27F2
File Size: 165.38 KB, 165376 bytes
MD5: 795dd47665d7cb322f9b2290b8114869
SHA1: 8559248321c093ab33b7893084272733d13883be
SHA256: CBDF39A9080DCC39649482DBE41E88971471B11987CEDA43A1684D8A3CFA1A22
File Size: 603.14 KB, 603136 bytes
MD5: cd6c8442766d734414065d8ac58213a4
SHA1: 5b63bf1de40dbcc9c21594b27d6d5adf1045ddc7
SHA256: 4BC2755ED2AFE720C0607162D89909A7F532E20F8B7F799D225B0E9B51EFC90E
File Size: 170.50 KB, 170496 bytes
MD5: 9e27f31e19f4b51686a91b7632d04df6
SHA1: 5a1641ae9dc6bde5486797935e1f45bdc5c8bb9f
SHA256: 45289D174B2C88C3DE9597B8427C8D280A092237018BB7F9D0A51F451B81E59E
File Size: 73.22 KB, 73216 bytes
MD5: 24aefe212f7af4e1c78dd62b5fef6b59
SHA1: fbeba01d786d0248d835d0d1f05861ff45aa6d0f
SHA256: 0864190440736BCDC6E38F39D188C5E07294C94ECD18DF9376ED23B3E2878345
File Size: 1.95 MB, 1951744 bytes
MD5: f7a87b4f13451a4c3557326a9815b141
SHA1: 80ce39bf3646624dca077aee97f1b01ac492e07f
SHA256: 44CAF675BC2DA0A7496F9BE90D2AAB44B7F29B3C4E3B10A569BA103D4ECDEA0F
File Size: 170.50 KB, 170496 bytes
MD5: 91cd0df828f5394cd1959fbbb204cb1d
SHA1: 57a12f257fdb5c48d6d981e7ff6ad25c48eb7716
SHA256: 930CC473C31064C71ECAE002E305C8323B938C239B531A883828DE5B9B2A9B29
File Size: 93.70 KB, 93696 bytes
MD5: d55c78dcca5ab69a20fc3d3df4ac13b5
SHA1: 71fed41e3bfbdb2c20cf9aeec506f5a9422873d2
SHA256: 62A3591B0DF7C28A803D62DE6BCA1FB74B9A9B46CE2BB5BFA854E7CC14BB6D83
File Size: 1.04 MB, 1043968 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have resources
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 32-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Bin Type 32
Build Date 2011/12/19-15:10:44
Build I D 18678
Build Version 66.490550
Comments EZTwain Pro Library
Company Name
  • Adobe Inc.
  • Adobe Systems Incorporated
  • Alexander Roshal
  • Atalasoft (www.atalasoft.com)
  • Microsoft Corporation
  • Nokia Corporation and/or its subsidiary(-ies)
  • Nuance Communications, Inc.
  • PFU Limited
  • The OpenSSL Project, https://www.openssl.org/
  • The Qt Company Ltd.
Show More
  • TODO: <Company name>
  • VMware, Inc.
  • Zhuhai Kingsoft Office Software Co.,Ltd
  • ©, Inc.
Compiler Hybrid
File Description
  • Adobe Color Engine
  • Adobe Crash Reporter Client DLL
  • C++ Application Development Framework
  • C++ application development framework.
  • EZTwain Pro Library
  • kprt
  • MFCDLL Shared Library - Retail Version
  • Microsoft ® C/C++ Compiler Front End
  • OpenSSL library
  • PaperPort File and Rendering
Show More
  • RAR decompression library
  • Recognita Scanner Driver
  • SsUCommon DLL
  • TODO: <File description>
  • VMware base library
File Version
  • Release 32-bit 7.04/1062
  • 22.0.35723.115 built by: d17.13
  • 17.6.2 build-24409262
  • 14.7.22568.2000
  • 14.5.15069.1503
  • 12.0.0
  • 12,9,0,21549
  • 12,1,0,25865
  • 10.00.40219.473
  • 5.15.2.0
Show More
  • 4.7.0.0
  • 4.0.6.1
  • 3.93.0
  • 3.0.7
  • 3, 0, 0, 108
  • 2.19.17.18678
  • 1.0.0.1
  • 1, 2, 35, 3
Internal Name
  • ACE
  • cpfe.DLL
  • CRClient.dll
  • Eztwain3
  • krpt
  • libcrypto
  • MAXKERNL
  • MFC100U.DLL
  • ProfileData.dll
  • RnRSDu.DLL
Show More
  • SCommon.dll
  • SsUCommon.dll
  • vmwarebase
Legal Copyright
  • (c) 1995-2015, Nuance Communications, Inc.
  • Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  • Copyright (C) 2020 The Qt Company Ltd.
  • Copyright 1998-2023 The OpenSSL Authors. All rights reserved.
  • Copyright 2023 Adobe.All Rights Reserved.
  • Copyright PFU Limited 2014-2022
  • Copyright PFU Limited 2021-2022
  • Copyright © 1995-2015 Nuance Communications, Inc.
  • Copyright © 1998-2024 Broadcom.
  • Copyright©2025 Kingsoft Corporation. All rights reserved.
Show More
  • Copyright©2026 Kingsoft Corporation. All rights reserved.
  • TODO: (c) <Company name>. All rights reserved.
  • © 1999-2011 Adobe Systems Incorporated
  • © 2022, Kofax Inc.
  • ©Atalasoft, a Kofax company. All Rights Reserved.
  • © Microsoft Corporation. All rights reserved.
  • © Microsoft Corporation. All rights reserved.
Legal Trademarks
  • EZTwain and EZTwain Pro are trademarks of Atalasoft.
  • Kofax, ScanSoft, Recognita, Power PDF, PaperPort, OmniPage, and OmniPage Capture SDK are registered trademarks of Kofax Inc. in the United States and/or other countries.
  • Nuance, ScanSoft, Recognita, OmniPage, PaperPort, Power PDF, and OmniPage Capture SDK are registered trademarks of Nuance Communications, Inc. in the United States and/or other countries.
  • Nuance, ScanSoft, Recognita, PaperPort, OmniPage and OmniPage Capture SDK are registered trademarks of Nuance Communications, Inc.
Original Filename
  • ACE.dll
  • cpfe.DLL
  • CRClient.dll
  • Eztwain3.dll
  • krpt.dll
  • libcrypto
  • MAXKERNL.DLL
  • MFC100U.DLL
  • ProfileData.dll
  • Qt5Network.dll
Show More
  • QtCore4.dll
  • RnRSDu.DLL
  • SCommon.dll
  • SsUCommon.dll
  • Unrar.dll
  • vmwarebase.dll
Product Name
  • ACE 2011/12/19-15:10:44
  • Adobe Crash Reporter Client DLL
  • EZTwain Pro
  • Microsoft® Visual Studio®
  • Microsoft® Visual Studio® 10
  • Nuance Imaging Products / Scanning Subsystem
  • PaperPort
  • PaperStream ClickScan
  • Qt4
  • Qt5
Show More
  • RAR decompression library
  • SsUCommon.dll
  • The OpenSSL Toolkit
  • TODO: <Product name>
  • VMware Workstation
  • WPS Office
Product Version
  • Release 32-bit 7.04/1062
  • 66.490550
  • 17.6.2 build-24409262
  • 17.0.35723.115
  • 14.71
  • 14.5
  • 12.0.0.202304060538_39d0b25
  • 12,9,0,21549
  • 12,1,0,25865
  • 10.00.40219.473
Show More
  • 5.15.2.0
  • 4.0.6.1
  • 3.0.7
  • 3.0
  • 1.0.0.1
  • 1, 2, 35, 3

Digital Signatures

Signer Root Status
AOMEI International Network Limited COMODO RSA Certification Authority Hash Mismatch
Broadcom Inc DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 Hash Mismatch
NetEase (Hangzhou) Network Co., Ltd DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 Hash Mismatch
Tencent Technology (Shenzhen) Company Limited DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 Hash Mismatch
Zhuhai Kingsoft Office Software Co., Ltd. DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 Hash Mismatch
Show More
Zhuhai Kingsoft Office Software Co., Ltd. DigiCert Trusted Root G4 Hash Mismatch
Nitro Software, Inc. GlobalSign Code Signing Root R45 Hash Mismatch
AOMEI International Network Limited GlobalSign CodeSigning CA - G3 Hash Mismatch
Microsoft Corporation Microsoft Code Signing PCA Hash Mismatch
Microsoft Corporation Microsoft Code Signing PCA 2011 Hash Mismatch

File Traits

  • 2+ executable sections
  • CryptUnprotectData
  • Default Version Info
  • dll
  • HighEntropy
  • imgui
  • WriteProcessMemory
  • x86

Block Information

Total Blocks: 3,371
Potentially Malicious Blocks: 4
Whitelisted Blocks: 3,358
Unknown Blocks: 9

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x ? 0 ? ? x ? ? 0 ? x ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Agent.ISD
  • Downloader.Agent.EG
  • Kryptik.HFH
  • Loader.DE
  • Rugmi.FG
Show More
  • Rugmi.GDA
  • Rugmi.GI
  • Rugmi.HB
  • Rugmi.IFB
  • Rugmi.O
  • Rugmi.OA
  • Rugmi.PG
  • ShellcodeRunner.FN
  • Trojan.Downloader.Gen.AEJ
  • Trojan.Downloader.Gen.AGB
  • Trojan.Downloader.Gen.AGR
  • Trojan.Downloader.Gen.AHH
  • Trojan.Downloader.Gen.AW
  • Trojan.Downloader.Gen.BA
  • Trojan.Downloader.Gen.JY
  • Trojan.Downloader.Gen.KF
  • Trojan.Downloader.Gen.SH
  • Trojan.ShellcodeRunner.Gen.LC

Files Modified

File Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtQueryAttributesFile
Show More
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWriteFile
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c66998ed5b5ffe5aadfb2e59def9ca9a81dcd93f_0003745792.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\3f1b9e36c52c6ed520b781fdf9730aaa7936b75a_0001289216.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\f33175ff326eacf6ec31c8c08a359deaccdf1b63_0001032936.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\2f0ebdd14c23c173680c262c6cdfa0ea2a850f76_0001805824.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\669cc7f735f6cb2bbbcedc7098ceafd813662c06_0002417832.,LiQMAxHB
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\3f0889b7932befdafa444c6379ee1b7b1c6e826e_0001565848.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\69912c04143b9a764a447b0e3921e3c348fdbf62_0000951296.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\f93e47be37cc1d0f1bb9af72a965009c6826725e_0007027576.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e4fc4956c5817546de3de22b2e1d71bc9b99b913_0000103928.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\856925784279092a79729f2639252cf2effd0491_0004425880.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\679e14bd529c9fad7da897189cdcc2355a04b1cc_0000821760.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e99e07a6446af3a6e0b9a19199665dd9fd2a9eea_0005435936.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e6b0a0fe97ad9329dbd0528fe6f516328e1715d1_0000372736.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\7e594f22019af05726a6ea67d63cbf7487a6b692_0000170496.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e8a1e4dce282be88536a2d2f3bf1711a8889b637_0000165376.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\8559248321c093ab33b7893084272733d13883be_0000603136.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5b63bf1de40dbcc9c21594b27d6d5adf1045ddc7_0000170496.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5a1641ae9dc6bde5486797935e1f45bdc5c8bb9f_0000073216.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\fbeba01d786d0248d835d0d1f05861ff45aa6d0f_0001951744.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\80ce39bf3646624dca077aee97f1b01ac492e07f_0000170496.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\57a12f257fdb5c48d6d981e7ff6ad25c48eb7716_0000093696.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\71fed41e3bfbdb2c20cf9aeec506f5a9422873d2_0001043968.,LiQMAxHB