Description date

29 September 2015

Description of malware class


A malicious program intended to delete, block, modify, or copy data, or disrupt computers or networks without the user's authorization, but which cannot be classified under any of the other Trojan behaviors.

This classification also includes “multipurpose” Trojan programs, i.e., those that are capable of performing several actions simultaneously and demonstrate multiple Trojan behaviors in a single program, preventing classification under one specific behavior.

Description of platform


Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.

Description of malware family


Malicious programs of this family are used to destroy, block, modify, or copy data, or to disrupt the performance of computers or networks.

Geographical distribution of attacks by the Trojan.Win32.Agent family

Geographical distribution of attacks during the period from 27 September 2014 to 27 September 2015

Top 10 countries with most attacked users (% of total attacks)

Country % of users attacked worldwide*
1 Russia 21.39
2 India 11.75
3 Vietnam 9.02
4 USA 4.02
5 Germany 3.65
6 Mexico 2.71
7 Brazil 2.66
8 Ukraine 2.19
9 France 2.19
10 Kazakhstan 2.09

* Percentage among all unique Kaspersky Lab users worldwide who were attacked by this malware