Categories: PUA

About “PUA.AgentRI.S24813025” infection

The PUA.AgentRI.S24813025 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA.AgentRI.S24813025 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Dynamic (imported) function loading detected
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to modify proxy settings
Harvests cookies for information gathering

How to determine PUA.AgentRI.S24813025?


File Info:
name: B161D9895ABD6E06C338.mlwpath: /opt/CAPEv2/storage/binaries/58a484e35c6d339801d90376b7b1e3df27ad8ad0a0fcee46185271b07ec3cbaacrc32: 66B9F786md5: b161d9895abd6e06c338fa38733b2e45sha1: 91f078cef24caaf7498aaff5517d4da6d277189csha256: 58a484e35c6d339801d90376b7b1e3df27ad8ad0a0fcee46185271b07ec3cbaasha512: e8791fb93c2143ce9dd1622b61608d5653bf97d49c9ab0661a9dc4891c777e27d941d2a366d63c92a61ba6942316b7e487a96b18035e4966da75852cd5588316ssdeep: 24576:l3rskPbNxm0TDWvknxNcKi2Mc/DDC8XlLmtYm+PPW6JQoSws+Opv5sh3y4aJM8dK:NPhxm0PWvt8oUWkQTneKoDcTTfjZospQtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T16B65BF21B841C032E66201F1857DAB698ABCBE30076594D7E3D87E689F705D2BB3771Bsha3_384: cfc13510b3ab62706b98390b164fc9b967bf1c0a2f8b07d21e2b576b50da2ad1beed776154d9738714d417da27d570b2ep_bytes: e82d080000e98efeffff8b4df464890dtimestamp: 2021-04-19 07:09:37
Version Info:
CompanyName: 上海展盟网络科技有限公司FileDescription: upgrade.exeFileVersion: 3.3.0.2InternalName: upgrade.exeLegalCopyright: Copyright © 2019 上海展盟网络科技有限公司 All Rights ReservedOriginalFilename: upgrade.exeProductName: upgrade.exeProductVersion: 3.3.0.2Translation: 0x0804 0x04b0

PUA.AgentRI.S24813025 also known as:

Bkav	W32.AIDetect.malware1
Lionic	Adware.Win32.KuziTui.2!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.80351
FireEye	Generic.mg.b161d9895abd6e06
CAT-QuickHeal	PUA.AgentRI.S24813025
McAfee	GenericRXQV-BD!B161D9895ABD
Cylance	Unsafe
Sangfor	Virus_Suspicious.Win32.Sality.bh
K7AntiVirus	Adware ( 00565ab71 )
Alibaba	AdWare:Win32/KuaiZip.5976cadf
K7GW	Adware ( 00565ab71 )
Cybereason	malicious.ef24ca
Arcabit	Trojan.Generic.D139DF
BitDefenderTheta	Gen:NN.ZexaF.34062.yD2@aGy@AFlj
Cyren	W32/KuaiZip.T.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/KuaiZip.AB potentially unwanted
TrendMicro-HouseCall	PE_SALITY.ER
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	not-a-virus:HEUR:AdWare.Win32.KuziTui.gen
BitDefender	Trojan.GenericKDZ.80351
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
Tencent	Pua:Adware.Win32.Kuzitui.16000040
Ad-Aware	Trojan.GenericKDZ.80351
Sophos	Generic PUA JB (PUA)
DrWeb	Trojan.Siggen15.13229
VIPRE	Virus.Win32.Sality.atbh (v)
McAfee-GW-Edition	BehavesLike.Win32.Dropper.th
SentinelOne	Static AI – Malicious PE
Emsisoft	Trojan.GenericKDZ.80351 (B)
APEX	Malicious
Jiangmin	AdWare.KuziTui.abo
Avira	TR/Patched.Ren.Gen
Antiy-AVL	Trojan/Win32.Generic
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ViRobot	Adware.Kuzitui.1448328.I
GData	Trojan.GenericKDZ.80351
Acronis	suspicious
VBA32	BScope.Adware.Burden
ALYac	Trojan.GenericKDZ.80351
MAX	malware (ai score=82)
Malwarebytes	PUP.Optional.Kuaizip
Rising	Adware.Agent!1.C6CF (CLASSIC)
Ikarus	Trojan.Win32
eGambit	Unsafe.AI_Score_71%
Fortinet	Adware/KuaiZip.AB
AVG	Win32:Sality [Inf]
Avast	Win32:Sality [Inf]