Kaspersky Threats — Trojan-Dropper.Win32.Agent.tfqmqg

Class: Trojan-Dropper

Trojan-Dropper programs are designed to secretly install malicious programs built into their code to victim computers. This type of malicious program usually save a range of files to the victim’s drive (usually to the Windows directory, the Windows system directory, temporary directory etc.), and launches them without any notification (or with fake notification of an archive error, an outdated operating system version, etc.). Such programs are used by hackers to: secretly install Trojan programs and/or viruses protect known malicious programs from being detected by antivirus solutions; not all antivirus programs are capable of scanning all the components inside this type of Trojans.

Read more

Platform: Win32

Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.

Family: Trojan.Win64.Agent

No family description

Examples

A7384B0A884D8681E763757625A8A68A
D4F20CAEF0B20F5F9CD5F3550664AFFA
1475E3D7E0436347D54F0BA6B8A21159
CFDA3EF7CC5579A17635EC940B78E617
7F5E7B5023290ECBAC3331BB79781FE3

Tactics and Techniques: Mitre*

TA0005

Defense Evasion

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_reu202Egnp.js will be displayed as photo_high_resj.png.

T1036.002

Right-to-Left Override