Categories: Malware

What is “Mal/Generic-R + Troj/Agent-AFVO”?

The Mal/Generic-R + Troj/Agent-AFVO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/Generic-R + Troj/Agent-AFVO virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Executed a process and injected code into it, probably while unpacking
Behavioural detection: Injection (inter-process)

How to determine Mal/Generic-R + Troj/Agent-AFVO?


File Info:
name: AEAD53E3EB98BD0039CC.mlwpath: /opt/CAPEv2/storage/binaries/6d5fe16e79c42281f39b5fcc5cbd3b52f800591c0e448be37f37b6334f038031crc32: A93C6426md5: aead53e3eb98bd0039cc4c85b556bd30sha1: 1bcd5b255945e84d5b4459099694438f13df5db8sha256: 6d5fe16e79c42281f39b5fcc5cbd3b52f800591c0e448be37f37b6334f038031sha512: 1a80c7410d0befb5598b46cb63b4488b659a518a9b13e150f8db8261ac421dcbbd3176419f19ac4e5c353469503cbff446185bb4e7b14b77160fe76d17bea44essdeep: 6144:y6KYUASfq3GlB0AvGGFXH1T7+rRaAVOlMumyVeL:lUA81MmGS7+clM/Ftype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1AD541202D31E50A2E50E7DB016A9E3E6AC7B6C113727236BBEB5386F127967508F11DCsha3_384: 1032212dc409baf2ae6fb11938114f1afc9abe634c8594ee55cee3c9a73706c8e159f17b5c68401de72099e6c232e577ep_bytes: 6a00ff15c82040008b44240c85c07518timestamp: 2014-01-30 05:44:40
Version Info:
FileDescription: LexinnyFileVersion: 2.0.7.9InternalName: LexinnyLegalCopyright: Copyright © 1998-2014ProductVersion: 2.0.7.9Translation: 0x0409 0x04b0

Mal/Generic-R + Troj/Agent-AFVO also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.ProcessHijack.sq0@aiWmxYk
FireEye	Generic.mg.aead53e3eb98bd00
CAT-QuickHeal	TjnPWS.Zbot.S12447
ALYac	Gen:Trojan.ProcessHijack.sq0@aiWmxYk
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Spyware.Win32.Zbot.8
K7AntiVirus	Trojan ( 004daf6c1 )
Alibaba	TrojanPSW:Win32/ProcessHijack.a30021ea
K7GW	Trojan ( 004daf6c1 )
Cybereason	malicious.3eb98b
BitDefenderTheta	Gen:NN.ZexaF.34212.sq0@aiWmxYk
VirIT	Trojan.Win32.Generic.ZOY
Cyren	W32/Zbot.PT.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Spy.Zbot.AAU
TrendMicro-HouseCall	TSPY_ZBOT.SMAA7
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Trojan.ProcessHijack.sq0@aiWmxYk
NANO-Antivirus	Trojan.Win32.Zbot.ctirzs
ViRobot	Trojan.Win32.U.Agent.299008.A
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.10b58425
Ad-Aware	Gen:Trojan.ProcessHijack.sq0@aiWmxYk
Sophos	Mal/Generic-R + Troj/Agent-AFVO
Comodo	TrojWare.Win32.Spy.Zbot.BT@596eyr
DrWeb	Trojan.PWS.Panda.5908
Zillya	Trojan.Zbot.Win32.147663
TrendMicro	TSPY_ZBOT.SMAA7
McAfee-GW-Edition	PWSZbot-FQM!AEAD53E3EB98
Emsisoft	Gen:Trojan.ProcessHijack.sq0@aiWmxYk (B)
APEX	Malicious
GData	Gen:Trojan.ProcessHijack.sq0@aiWmxYk
Jiangmin	TrojanSpy.Zbot.ebjs
eGambit	Generic.PSW
Avira	TR/Agent.abxa.14
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.7D8391
SUPERAntiSpyware	Trojan.Agent/Gen-Luder
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	PWS:Win32/Zbot.AJB
SentinelOne	Static AI – Suspicious PE
AhnLab-V3	Trojan/Win32.Zbot.R96860
McAfee	PWSZbot-FQM!AEAD53E3EB98
TACHYON	Trojan/W32.ZBot.299008.D
VBA32	Malware-Cryptor.Inject.gen
Malwarebytes	Trojan.Zbot
Rising	Trojan.Injector!8.C4 (CLOUD)
Yandex	TrojanSpy.Zbot!belvt9nnyM4
Ikarus	Virus.Win32.Zbot
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Injector.PDA!tr
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_60% (D)