Malware

MSIL/Agent.XQ removal

Malware Removal

The MSIL/Agent.XQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What MSIL/Agent.XQ virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid

How to determine MSIL/Agent.XQ?



File Info:

name: CC36922AF0D0D16337F5.mlw
path: /opt/CAPEv2/storage/binaries/cd81b93318772dcf032b0fe40a9b5469d2514c591b73f68fc69b5b4c0cfcd435
crc32: F762573F
md5: cc36922af0d0d16337f5086608190ca5
sha1: 9fde9f31f5e6f7182895bc336395884844949f09
sha256: cd81b93318772dcf032b0fe40a9b5469d2514c591b73f68fc69b5b4c0cfcd435
sha512: a81ceee75059686ce0ab37d6c2ee80d115c0f0ea67a60f69133b12fe5f7cf594809b72f3f4105b6638ceb2cb68add92b36b8aa528dec5ce14d78f02a1318057b
ssdeep: 96:UuYDFWd2TP9vkoiqDvqvBSWshfOFSbrWp5UWmzNt:Xw9vkaDuAVkkbCpeD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T137D1C61053E8473BFDEEC73A5B7323006BF0B34385265F4E25C982675E537A44942AA1
sha3_384: b5bb08993e933b9b9189009d59b1767c3dc347751f859887294bfdd26ad93be9baa2ba8e5e54e2cede042acdc350fea6
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-09-27 13:37:56


Version Info:

Translation: 0x0000 0x04b0
FileDescription: Dragtor
FileVersion: 1.0.8305.19138
InternalName: Dragtor.exe
LegalCopyright: Copyright 2022
OriginalFilename: Dragtor.exe
ProductName: Dragtor
ProductVersion: 1.0.8305.19138
Assembly Version: 1.0.8305.19138

MSIL/Agent.XQ also known as:

LionicTrojan.MSIL.Fsysna.4!c
MicroWorld-eScanTrojan.GenericKD.62398999
FireEyeTrojan.GenericKD.62398999
McAfeeRDN/Generic.dx
CylanceUnsafe
VIPRETrojan.GenericKD.62398999
SangforTrojan.Msil.Fsysna.Vaad
K7AntiVirusTrojan ( 004b85711 )
AlibabaWorm:Win32/MalwareX.02bbff16
K7GWTrojan ( 004b85711 )
CyrenW32/MSIL_Agent.EHT.gen!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/Agent.XQ
APEXMalicious
KasperskyHEUR:Trojan.MSIL.Fsysna.gen
BitDefenderTrojan.GenericKD.62398999
NANO-AntivirusTrojan.Win32.Fsysna.jsuazr
AvastWin32:MalwareX-gen [Trj]
TencentMalware.Win32.Gencirc.10bbcb1e
Ad-AwareTrojan.GenericKD.62398999
ZillyaWorm.Agent.Win32.192211
TrendMicroTROJ_GEN.R002C0PJ422
McAfee-GW-EditionRDN/Generic.dx
SophosMal/Generic-S
GDataTrojan.GenericKD.62398999
JiangminTrojan.MSIL.anmmk
AviraWORM/Agent.ujshv
Antiy-AVLTrojan/MSIL.Agent
KingsoftWin32.Troj.Undef.(kcloud)
ArcabitTrojan.Generic.D3B82217
MicrosoftTrojan:Win32/Wacatac.B!ml
GoogleDetected
AhnLab-V3Trojan/Win.Generic.C5246256
ALYacTrojan.GenericKD.62398999
MAXmalware (ai score=87)
TrendMicro-HouseCallTROJ_GEN.R002C0PJ422
RisingTrojan.Fsysna!8.5F2 (CLOUD)
YandexWorm.Agent!31hqkWBsY2M
IkarusWorm.MSIL.Agent
MaxSecureTrojan.Malware.73694066.susgen
FortinetMSIL/Agent.VSS
AVGWin32:MalwareX-gen [Trj]
PandaTrj/Chgt.AD
CrowdStrikewin/malicious_confidence_100% (W)

How to remove MSIL/Agent.XQ?

MSIL/Agent.XQ removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment