Categories: Trojan

AIT:Trojan.Agent.EFKN removal tips

The AIT:Trojan.Agent.EFKN file is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What AIT:Trojan.Agent.EFKN virus can do?

  • CAPE detection: Executable code extraction
  • Creates RWX memory
  • Expresses interest in specific running processes
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • The binary likely contains encrypted or compressed data.
  • Anomalous binary characteristics

How to determine AIT:Trojan.Agent.EFKN?


General:

Operating System: Windows 7 / 8 / 8.1 / 10 Virus Name: AutoIt:Injector-JE [Trj]

File Info:

Name: bupx.exe

Size: 1142784

Type: PE32 executable (GUI) Intel 80386, for MS Windows

MD5: f0a7a1ef68bf80596ec2048e4740cde2

SHA1: 31ea4c2649c0f7d6ac86e277aee377a149df38b0

SH256: 3a7e74024c233663dc9b627117a4df291f5a413cc829b5282f090941254365ee

Version Info:

[No Data]

AIT:Trojan.Agent.EFKN also known as:

ALYac Trojan.Agent.Wacatac
APEX Malicious
AVG AutoIt:Injector-JE [Trj]
Ad-Aware AIT:Trojan.Agent.EFKN
AegisLab Trojan.Win32.AutoIt.4!c
AhnLab-V3 Malware/Win32.Generic.R294758
Alibaba Trojan:Win32/Autoit.67523518
Antiy-AVL GrayWare/Autoit.Execute.a
Avast AutoIt:Injector-JE [Trj]
Avira DR/AutoIt.Gen8
BitDefender AIT:Trojan.Agent.EFKN
BitDefenderTheta Gen:NN.ZexaCO3.32250.fvW@aqSg@2ci
CAT-QuickHeal Trojan.Autoit
Comodo Malware@#1dk2fbyhakacj
CrowdStrike win/malicious_confidence_90% (W)
Cybereason malicious.649c0f
Cylance Unsafe
DrWeb Trojan.AutoIt.625
ESET-NOD32 a variant of Win32/Injector.Autoit.EKQ
Emsisoft AIT:Trojan.Agent.EFKN (B)
Endgame malicious (high confidence)
F-Secure Dropper.DR/AutoIt.Gen8
FireEye Generic.mg.f0a7a1ef68bf8059
Fortinet AutoIt/Injector.EKY!tr
GData AIT:Trojan.Agent.EFKN
Ikarus Trojan.Autoit
Invincea heuristic
K7AntiVirus Trojan ( 0055996f1 )
K7GW Trojan ( 0055996f1 )
Kaspersky HEUR:Trojan.Win32.AutoIt.gen
MAX malware (ai score=100)
Malwarebytes Trojan.MalPack.AutoIt
McAfee Artemis!F0A7A1EF68BF
McAfee-GW-Edition BehavesLike.Win32.Downloader.tc
MicroWorld-eScan AIT:Trojan.Agent.EFKN
Microsoft Trojan:Win32/Tiggre!rfn
NANO-Antivirus Trojan.Win32.AutoIt.ghgsmh
Paloalto generic.ml
Panda Trj/CI.A
Qihoo-360 Win32/Trojan.a43
Rising Trojan.Obfus/Autoit!1.BD7E (CLASSIC)
SentinelOne DFI – Malicious PE
Sophos Mal/Generic-S
Symantec Packed.Generic.548
TrendMicro TROJ_GEN.R002C0PKB19
TrendMicro-HouseCall TROJ_GEN.R002C0PKB19
VBA32 Trojan.Autoit
VIPRE Trojan.Win32.Generic!BT
ZoneAlarm HEUR:Trojan.Win32.AutoIt.gen

How to remove AIT:Trojan.Agent.EFKN?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

MSIL/GenKryptik.GXIZ information

The MSIL/GenKryptik.GXIZ is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

Malware.AI.2789448175 (file analysis)

The Malware.AI.2789448175 is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

Jalapeno.1878 removal instruction

The Jalapeno.1878 is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

What is “Trojan.Heur3.LPT.YmKfaKBcBekib”?

The Trojan.Heur3.LPT.YmKfaKBcBekib is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

How to remove “Worm.Win32.Vobfus.exmt”?

The Worm.Win32.Vobfus.exmt is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

About “TrojanDownloader:Win32/Beebone.JO” infection

The TrojanDownloader:Win32/Beebone.JO is considered dangerous by lots of security experts. When this infection is active,…

2 months ago