Categories: Malware

Should I remove “Linux/Agent.HA”?

The Linux/Agent.HA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Linux/Agent.HA virus can do?

Injection (inter-process)
Injection with CreateRemoteThread in a remote process
Uses Windows utilities for basic functionality
Attempts to repeatedly call a single API many times in order to delay analysis time
A potential decoy document was displayed to the user
Network activity detected but not expressed in API logs
Harvests information related to installed mail clients

How to determine Linux/Agent.HA?


File Info:
crc32: E42DB675md5: 4dde761681684d7edad4e5e1ffdb940bname: tmpj0y7ind7sha1: 2327be693bc11a618c380d7d3abc2382d870d48bsha256: d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8sha512: 91a61c719128f263f9f95736d55895954cc468c74ff469ee061d35ec382c50b9165e9a5427dc46a835dac6ae0e6e1f9819632475f68b98a907b53196bd4eb02assdeep: 1536:3aQiZDMyqIlMBZ/R0F4E4kcHiNq98wk9njKZjjLuYo68864sNHFEzv7Ld76divkE:KzDMyqIMBZ/R0ufhBmgZy9yNsNmPtcEtype: ELF 32-bit MSB  executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Version Info:
0: [No Data]

Linux/Agent.HA also known as:

MicroWorld-eScan	Trojan.GenericKD.42882503
ClamAV	Unix.Malware.Agent-7464514-0
FireEye	Trojan.GenericKD.42882503
McAfee	ELF/BackDoor.b
Zillya	Trojan.Agent.Linux.2429
Symantec	Trojan.Gen.MBT
TrendMicro-HouseCall	Backdoor.Linux.GAFGYT.AOB
Avast	ELF:Mirai-ARH [Trj]
Cynet	Malicious (score: 85)
GData	Trojan.GenericKD.42882503
Kaspersky	HEUR:Backdoor.Linux.Gafgyt.a
BitDefender	Trojan.GenericKD.42882503
NANO-Antivirus	Trojan.Fgt.guanxk
ViRobot	Linux.S.Agent.108808
AegisLab	Trojan.Linux.Gafgyt.m!c
Tencent	Linux.Backdoor.Gafgyt.Phra
Ad-Aware	Trojan.GenericKD.42882503
Sophos	Mal/Generic-S
Comodo	Malware@#1byxy4joscal8
F-Secure	Malware.LINUX/Agent.leqib
DrWeb	Linux.BackDoor.Fgt.3003
VIPRE	Backdoor.ELF.Generic.a (v)
TrendMicro	Backdoor.Linux.GAFGYT.AOB
McAfee-GW-Edition	ELF/BackDoor.b
Emsisoft	Trojan.GenericKD.42882503 (B)
Ikarus	Trojan.Linux.Gafgyt
Cyren	E32/Trojan.UOGN-5
Jiangmin	Backdoor.Linux.dzna
Avira	LINUX/Agent.leqib
Antiy-AVL	Trojan[Backdoor]/Linux.Gafgyt
Microsoft	Trojan:Win32/Tiggre!plock
Arcabit	Trojan.Generic.D28E55C7
ZoneAlarm	HEUR:Backdoor.Linux.Gafgyt.a
AhnLab-V3	Backdoor/Linux.Gafgyt.108264
ALYac	Backdoor.Linux.Gafgyt
ESET-NOD32	Linux/Agent.HA
MAX	malware (ai score=100)
Fortinet	ELF/Gafgyt.A!tr.bdr
AVG	ELF:Mirai-ARH [Trj]
Qihoo-360	Linux/Backdoor.812