About "Application.Agent.GEX" infection

The Application.Agent.GEX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Application.Agent.GEX virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
At least one IP Address, Domain, or File Name was found in a crypto call
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Detects Sandboxie through the presence of a library
Tries to suspend Cuckoo threads to prevent logging of malicious activity
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Application.Agent.GEX?


File Info:
crc32: 5DAE8582
md5: e42d8bf0f8c16e0597d937f31d451a4e
name: yldfcxgq.exe
sha1: 267cd515a1a68f998de60c07f94c6b391a83de52
sha256: 47d2792b8a322c2aa8009e338e79b84488d6471a53c5709ac8dfa9d19be70ec6
sha512: 29bbcf46db3ddb8d6a76cd3f6087d17d4a5df2a9fc260eb5995c8a6d190915c860b9e17b66240f90efea3a5d8c4374e80279beaf115322e0cc254be6161418f3
ssdeep: 196608:xYJPo+b/hJRYGsDLbor7wqVmIVtl1HHK:S2+b/JY9DLborkqbJ1q
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: x6797x6bdbx4e4bx5bb6x7248x6743x6240x6709
FileVersion: 2.80.12.1228
CompanyName: x6797x6bdb
Comments: x6b22x8fcex5149x4e34x6211x7684x8bbax575b:www.51wyx.net
ProductName: x7ea2x8272x8b66x62122x4feex6539x5927x5e08x7f
ProductVersion: 2.80.12.1228
FileDescription: x7ea2x8272x8b66x62122x4feex6539x5927x5e08x7f
x63d0x4f9bx7ea2x8272x8b66x62122x5185x5b58x4feex6539x7684x529fx80fd
Translation: 0x0804 0x04b0

Application.Agent.GEX also known as:

MicroWorld-eScan	Application.Agent.GEX
CAT-QuickHeal	HackTool.Prepscram
McAfee	Artemis!E42D8BF0F8C1
Cylance	Unsafe
VIPRE	VirTool.Win32.Obfuscator.XZ (v)
K7AntiVirus	Unwanted-Program ( 004eb1401 )
K7GW	Unwanted-Program ( 004eb1401 )
Cybereason	malicious.0f8c16
Arcabit	Application.Agent.GEX
Invincea	heuristic
ESET-NOD32	a variant of Win32/FlyStudio.HackTool.A potentially unwanted
APEX	Malicious
Avast	FileRepMetagen [Malware]
ClamAV	Win.Trojan.Agent-6323130-0
BitDefender	Application.Agent.GEX
NANO-Antivirus	Trojan.Win32.Agent.dgpydw
Rising	Trojan.Generic@ML.96 (RDMK:MnkXJxJgIA48amqin4dzfQ)
Endgame	malicious (high confidence)
Emsisoft	Application.Agent.GEX (B)
Comodo	TrojWare.Win32.Agent.OSCF@5rs7jr
F-Secure	Trojan.TR/Agent.7061504.1
TrendMicro	TROJ_GEN.R002C0RIS19
McAfee-GW-Edition	BehavesLike.Win32.LoadMoney.vc
Fortinet	W32/FlyStudio_HackTool.A
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.e42d8bf0f8c16e05
Sophos	Mal/VMProtBad-A
Ikarus	Trojan.Agent
MaxSecure	Trojan.Malware.300983.susgen
MAX	malware (ai score=72)
Microsoft	SoftwareBundler:Win32/Prepscram
Acronis	suspicious
Ad-Aware	Application.Agent.GEX
TrendMicro-HouseCall	TROJ_GEN.R002C0RIS19
SentinelOne	DFI – Suspicious PE
eGambit	Unsafe.AI_Score_80%
GData	Application.Agent.GEX
Webroot	W32.Malware.Gen
AVG	FileRepMetagen [Malware]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Application.Agent.GEX?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Application.Agent.GEX” infection