Trojan:Win32/FlyAgent!pz - ThreatCheck.sh

user@threatcheck.sh ~ threat-analysis

bash

$ analyze-threat Trojan:Win32/FlyAgent!pz

Trojan:Win32/FlyAgent!pz - Windows Defender threat signature analysis

$ cat analysis.txt

=== THREAT ANALYSIS REPORT ===

Threat Name: Trojan:Win32/FlyAgent!pz

Classification:

Type:Trojan

Platform:Win32

Family:FlyAgent

Detection Type:Concrete

Known malware family with identified signatures

Suffix:!pz

Packed or compressed to evade detection

Confidence:Very High

False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for 32-bit Windows platform, family FlyAgent

VDM Static Detection:

Relevant strings associated with this threat:
 - SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp (PEHSTR_EXT)
 - SOFTWARE\Policies\Microsoft\Windows\Installer\EnableAdminTSRemote (PEHSTR_EXT)
 - net view \\ (PEHSTR_EXT)
 - Local Settings\History\History.IE5\ (PEHSTR_EXT)
 - HARDWARE\DESCRIPTION\System\CentralProcessor\0\ (PEHSTR_EXT)
 -  mci command handling window (PEHSTR_EXT)
 - image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword (PEHSTR_EXT)
 - \a3.ini (PEHSTR_EXT)
 - _And xMe.bat (PEHSTR_EXT)
 - Sky\E\Install\Path (PEHSTR_EXT)
 - on.exe (PEHSTR_EXT)
 - _And DeleteMe.bat (PEHSTR_EXT)
 - Software\FlySky\E\Install\Path (PEHSTR_EXT)
 - \msyianjiup. (PEHSTR_EXT)
 - Microsoft\VBS3.vbs (PEHSTR_EXT)
 - Microsoft\svchcst.exe (PEHSTR_EXT)
 - Microsoft\Config.ini (PEHSTR_EXT)
 - cmd.exe /c del svchcst.exe (PEHSTR_EXT)
 - Start Menu\Programs\Startup\wins.lnk (PEHSTR_EXT)
 - CurrentVersion\Run\360safo (PEHSTR_EXT)
 - \Windows\CurrentVersion\Run\360sofe (PEHSTR_EXT)
 - @Microsoft\Config.ini (PEHSTR_EXT)
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForSoftwarePacking.C!pli (PEHSTR_EXT)

Known malware which is associated with this threat:

Filename: 8654411303cde9d3.exe

8654411303cde9d37997f9a7d3e334b2f9640021a2099bc97a75badb92fad9a4

22/03/2026

→VirusTotal ↓Download Sample

Filename: 760c768636b63ffd.exe

760c768636b63ffd7c8b053298de81f19a8583626e72a3c2eb88b1ae33a9bf0a

22/03/2026

→VirusTotal ↓Download Sample

Filename: c97dd7d1c7415789383ebc30741cc860eefeb03a1363637a29999c5ec5a1e876

c97dd7d1c7415789383ebc30741cc860eefeb03a1363637a29999c5ec5a1e876

22/03/2026