Kaspersky Threats — Trojan-Dropper.Win32.Agent.tfgqat

Class: Trojan-Dropper

Trojan-Dropper programs are designed to secretly install malicious programs built into their code to victim computers. This type of malicious program usually save a range of files to the victim’s drive (usually to the Windows directory, the Windows system directory, temporary directory etc.), and launches them without any notification (or with fake notification of an archive error, an outdated operating system version, etc.). Such programs are used by hackers to: secretly install Trojan programs and/or viruses protect known malicious programs from being detected by antivirus solutions; not all antivirus programs are capable of scanning all the components inside this type of Trojans.

Read more

Platform: Win32

Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.

Family: Trojan.Win64.Agent

No family description

Examples

1467C27673540271C6DEDAF9A17953E3
1209E92ECD5B38C20F58C6955A0B3228
4B460B9ADBA20F57D9C23751CFB9F5A8
0B0F0F7EA2F766E7609961D92739B13E
CE584FAA94EAA0F465A574A5642FFC37

Tactics and Techniques: Mitre*

TA0005

Defense Evasion

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_reu202Egnp.js will be displayed as photo_high_resj.png.

T1036.002

Right-to-Left Override