Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Malware
Threat report

Application.Agent.KLL malicious file

Published May 2, 2023 Malware category 3 min read
Report context

What to verify before removal

This report keeps Application.Agent.KLL malicious file in the active library because the detection has enough technical context to support a careful second-opinion scan and cleanup decision.

Start by comparing the local file name with 89A924342B42250A5DBB.mlw, then review the behavior notes for persistence entries, dropped files, unusual processes, and browser or network changes. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
89A924342B42250A5DBB.mlw
  • Compare the suspicious file name with 89A924342B42250A5DBB.mlw.
  • Confirm the detection name matches Application.Agent.KLL malicious file before removing related files.
  • Review the report for persistence entries, dropped files, unusual processes, and browser or network changes so the cleanup is based on observed behavior, not only the label.
  • Run a full scan, quarantine confirmed detections, and restart before signing back in to sensitive accounts.

The Application.Agent.KLL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Application.Agent.KLL virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Attempts to modify proxy settings
  • Harvests cookies for information gathering
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Application.Agent.KLL?



File Info:

name: 89A924342B42250A5DBB.mlw
path: /opt/CAPEv2/storage/binaries/594e9ad8fc30479349f251db7a37d0b95dc0dadf667165a178dcf6ae36da6457
crc32: 513B026B
md5: 89a924342b42250a5dbba5af8694faba
sha1: 4b33419ebfe3a6c67b713868208938f8b8564564
sha256: 594e9ad8fc30479349f251db7a37d0b95dc0dadf667165a178dcf6ae36da6457
sha512: 643cc18dd5f13c8e02bd3056645ede8838259fede6b637a960cef048a67b84154d2adde53a53914dbf4018e9cfc8755502507ee5adc267b254c49e2e3d2bb31f
ssdeep: 49152:JcA2YtrQLhlG4FJhtccVrx24jUnBST1Wj:+rYpQLhlG4FJcb4jCOWj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C2A5D002F15580F2D22D193958FA6735DE789E4D0A29CBCBA356FE691C33E90D63B20D
sha3_384: ccc09a6ed75676ea45d73b4357c91e9d99aeaa1e146837717b8d90625af51b432e995751db4d2fa84c34013c33c56350
ep_bytes: 558bec6aff68f0a35a006874764a0064
timestamp: 2022-03-24 16:31:20


Version Info:

FileVersion: 1.0.0.0
FileDescription: Launcher
ProductName: Launcher
ProductVersion: 1.0.0.0
LegalCopyright: Launcher
Comments: Launcher
Translation: 0x0804 0x04b0

Application.Agent.KLL also known as:

Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Dinwod.mgDt
AVG Win32:MiscX-gen [PUP]
tehtris Generic.Malware
MicroWorld-eScan Application.Agent.KLL
CAT-QuickHeal Risktool.Flystudio.16886
ALYac Application.Agent.KLL
Malwarebytes Ramnit.Virus.FileInfector.DDS
VIPRE Application.Agent.KLL
Sangfor Suspicious.Win32.Save.ins
K7AntiVirus Trojan ( 005246d51 )
Alibaba Trojan:Win32/FlyStudio.0020f7a0
K7GW Trojan ( 005246d51 )
CrowdStrike win/malicious_confidence_100% (W)
Cyren W32/S-965fe2e2!Eldorado
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Packed.FlyStudio.AA potentially unwanted
Cynet Malicious (score: 100)
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Generic-9820446-0
BitDefender Application.Agent.KLL
Avast Win32:MiscX-gen [PUP]
Emsisoft Application.Agent.KLL (B)
McAfee-GW-Edition BehavesLike.Win32.Generic.vc
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.89a924342b42250a
Sophos Generic Reputation PUA (PUA)
SentinelOne Static AI – Malicious PE
GData Win32.Trojan.PSE.15MOKEC
MAX malware (ai score=75)
Antiy-AVL Trojan/Win32.FlyStudio.a
Xcitium Worm.Win32.Dropper.RA@1qraug
Arcabit Application.Agent.KLL
Microsoft Trojan:Win32/Wacatac.A!ml
Google Detected
AhnLab-V3 Malware/Win.Malware-gen.R532120
McAfee Artemis!89A924342B42
Cylance unsafe
TrendMicro-HouseCall TROJ_GEN.R002H0CDC23
Ikarus PUA.FlyStudio
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/CoinMiner.PHP!tr
BitDefenderTheta Gen:NN.ZexaF.36164.bs0@aqkfZEeb
Cybereason malicious.ebfe3a
DeepInstinct MALICIOUS

How to remove Application.Agent.KLL?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.