PowerShell/Agent.HC information

The PowerShell/Agent.HC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PowerShell/Agent.HC virus can do?

Authenticode signature is invalid
Anomalous .NET characteristics

How to determine PowerShell/Agent.HC?


File Info:
name: ECED89A90E320DC3D5CE.mlw
path: /opt/CAPEv2/storage/binaries/374e4186e2f38096c494277d323bc99786d44598e041279d3986821cac0c5f5b
crc32: 26B7A68A
md5: eced89a90e320dc3d5ce71b5a667f09d
sha1: 95e9449e31cd13a0110009d1d1aa130c13e535f2
sha256: 374e4186e2f38096c494277d323bc99786d44598e041279d3986821cac0c5f5b
sha512: c9cf94c9dc7231b1e3e537a34a1e84d5ea8f29545bc913d022d7e27e90432c10d10c4f837ea69dcb4042ca9aa01fe10d403012e68291ef0b102486df27f4c3ad
ssdeep: 768:tBjFST01npUZyHlI2ckHXbOfq1UkgvIWYtaFoN:t1XpUZSdck3bOugzq3N
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EE23B3147AE8C03FF19F8AF82BD515207536F2FE1307D6921DB815EA9B937004E026A7
sha3_384: 72f35293609d4a8e5c0fe95995177969c85319560bed5eca5cb7c79a60bb845d6b48ec4cb80d2bc54a30e6de6abccb37
ep_bytes: ff250020400000000000000000000000
timestamp: 2020-11-12 18:01:17

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: modify_path_updated2.exe
LegalCopyright:  
OriginalFilename: modify_path_updated2.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

PowerShell/Agent.HC also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.MSIL.Downeks.l!c
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Trojan.GenericKD.48278671
FireEye	Generic.mg.eced89a90e320dc3
McAfee	Artemis!ECED89A90E32
Cylance	unsafe
Sangfor	Spyware.MSIL.Downeks.dpa
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	PowerShell/Agent.HC
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Spy.MSIL.Downeks.dpa
BitDefender	Trojan.GenericKD.48278671
NANO-Antivirus	Trojan.Win32.Downeks.jqrjiu
Avast	Win32:Malware-gen
Emsisoft	Trojan.GenericKD.48278671 (B)
VIPRE	Trojan.GenericKD.48278671
McAfee-GW-Edition	Artemis
Trapmine	suspicious.low.ml.score
Sophos	Generic Reputation PUA (PUA)
SentinelOne	Static AI – Malicious PE
GData	Trojan.GenericKD.48278671
Arcabit	Trojan.Generic.D2E0AC8F
ZoneAlarm	Trojan-Spy.MSIL.Downeks.dpa
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Malware/Win32.RL_Generic.C4320647
BitDefenderTheta	Gen:NN.ZemsilF.36164.dm0@aGv!gyb
ALYac	Trojan.GenericKD.48278671
MAX	malware (ai score=88)
VBA32	TrojanSpy.MSIL.Downeks
Malwarebytes	Generic.Malware/Suspicious
Rising	Spyware.Downeks!8.E248 (C64:YzY0Os+L9IupywYF)
Ikarus	SuspectFile
MaxSecure	Trojan.Malware.185155910.susgen
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS

How to remove PowerShell/Agent.HC?

PowerShell/Agent.HC removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X