What is “Application.DealAgent.AXG”?

The Application.DealAgent.AXG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Application.DealAgent.AXG virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Attempts to repeatedly call a single API many times in order to delay analysis time
Network activity detected but not expressed in API logs

How to determine Application.DealAgent.AXG?


File Info:
crc32: E00A13CD
md5: c0e8eb5dcc07cd809038380d5c2f84a3
name: C0E8EB5DCC07CD809038380D5C2F84A3.mlw
sha1: 705cdaeb9be1080310b6b8198d71312ed9602c73
sha256: 2c8fd7b7235e029cae1974b29ee4e53818697758d3c93a4f56b489dcff7c9858
sha512: 11c76a8a0f313bd4403d72dbe3a82c5b767b23cb8829bd5ea9c2c417d14e5ff18759b1a33639e698e68522bcf7d90149541a31fe0eb002933401d953858788b5
ssdeep: 24576:kdOwFIfRCrc5mCVWNYsaoWZSvfYWDrFle2PjrUGB5TVv1I52xEotV8imFs6tkeY:kcVRCY5mS7siZSIWNlLIGB5TVv1PWnVY
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Prog file                                                                                           
FileVersion: 3.2.1.0             
CompanyName:                                                             
Comments: This installation was built with Inno Setup.
ProductName: Tedu                                                        
ProductVersion: 2.3.1               
FileDescription: Tedu Setup                                                  
Translation: 0x0000 0x04b0

Application.DealAgent.AXG also known as:

DrWeb	Trojan.InstallCore.3436
Cynet	Malicious (score: 100)
ALYac	Application.DealAgent.AXG
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	AdWare:Win32/DealPly.484609c5
Cybereason	malicious.dcc07c
Symantec	PUA.Gen.2
ESET-NOD32	Win32/InstallCore.Gen.A potentially unwanted
Avast	Win32:Adware-gen [Adw]
Kaspersky	not-a-virus:AdWare.Win32.DealPly.dkgdb
BitDefender	Application.DealAgent.AXG
NANO-Antivirus	Virus.InnoSetup.Gen.ccng
MicroWorld-eScan	Application.DealAgent.AXG
Ad-Aware	Application.DealAgent.AXG
Sophos	InnoMod (PUA)
Comodo	Malware@#s0ndzc5wucm2
FireEye	Generic.mg.c0e8eb5dcc07cd80
Emsisoft	Application.DealAgent.AXG (B)
SentinelOne	Static AI – Malicious PE
Webroot	W32.DealPly.dkgdb
Microsoft	Trojan:Win32/Wacatac.A!ml
Arcabit	Application.DealAgent.AXG
GData	Win32.Application.InstallCore.LR@gen
MAX	malware (ai score=73)
VBA32	Malware-Cryptor.2LA.gen
Malwarebytes	PUP.Optional.InstallCore
Panda	PUP/RnkBend
Rising	Adware.InstallCore!1.AB2C (CLASSIC)
Fortinet	Adware/DealPly
AVG	Win32:Adware-gen [Adw]

How to remove Application.DealAgent.AXG?

Application.DealAgent.AXG removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X