Malware

PWS:Win32/Agent malicious file

Malware Removal

The PWS:Win32/Agent is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What PWS:Win32/Agent virus can do?

  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Yara detections observed in process dumps, payloads or dropped files

How to determine PWS:Win32/Agent?


File Info:

name: 3367D4A089F0F22742FB.mlw
path: /opt/CAPEv2/storage/binaries/fe643062a29eff407d62a5a95f1cdc36b34fd117002e8ea0e34f889d366c351f
crc32: 21599FC8
md5: 3367d4a089f0f22742fbc3e19af5c545
sha1: a4312dfd7a012847cefb6fdd40cfb4baef66ef06
sha256: fe643062a29eff407d62a5a95f1cdc36b34fd117002e8ea0e34f889d366c351f
sha512: 432d3bd23da25614795a625e560dcb3dbda67c5137fdd893ce81425fbd426ca2d1c83bbaf40ca90f56dae2a856dd8e609ce668d48dcdc52f88143c3bedb2e0fa
ssdeep: 384:xOBBQzUl3Vu29yLn69seas4X8708Pp9Z4380UYb:gBBmI0wCn69y8708h9Zd0UYb
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T13A72BF0A2E722B4DC19825315B934BCD0F33D0D0563A675969ED327DAFE3AD06E21E4B
sha3_384: b9a97add440fbf94a8659134cde0652534057b9fee544c890ad9777ab32e2a2686f1b8cb8ed00d96ac1d19ba9eb5819b
ep_bytes: 807c2408010f858601000060be002001
timestamp: 2007-03-26 16:05:38

Version Info:

0: [No Data]

PWS:Win32/Agent also known as:

LionicTrojan.Win32.Rumrux.i!c
MicroWorld-eScanGen:Adware.Heur.bmOfNGMkbyp
FireEyeGen:Adware.Heur.bmOfNGMkbyp
SkyhighBehavesLike.Win32.Downloader.lc
ALYacGen:Adware.Heur.bmOfNGMkbyp
Cylanceunsafe
ZillyaTrojan.Rumrux.Win32.25
CrowdStrikewin/malicious_confidence_90% (W)
AlibabaTrojanPSW:Win32/Rumrux.76f9ebe3
K7GWPassword-Stealer ( 000121ee1 )
K7AntiVirusPassword-Stealer ( 000121ee1 )
SymantecML.Attribute.HighConfidence
Elasticmalicious (moderate confidence)
ESET-NOD32a variant of Win32/PSW.Agent.KV
APEXMalicious
CynetMalicious (score: 100)
KasperskyTrojan-PSW.Win32.Rumrux.ak
BitDefenderGen:Adware.Heur.bmOfNGMkbyp
NANO-AntivirusTrojan.Win32.Rumrux.cwnoja
AvastWin32:Agent-DHX [Trj]
TencentWin32.Trojan-QQPass.QQRob.Bgow
EmsisoftGen:Adware.Heur.bmOfNGMkbyp (B)
F-SecureTrojan.TR/Spy.Gen
DrWebTrojan.PWS.Gamania
VIPREGen:Adware.Heur.bmOfNGMkbyp
TrendMicroTROJ_AGENT.WST
SophosMal/Dll-A
IkarusTrojan-PWS.Win32.Rumrux
GDataGen:Adware.Heur.bmOfNGMkbyp
JiangminTrojan/PSW.Rumrux.a
AviraTR/Spy.Gen
Antiy-AVLTrojan[PSW]/Win32.Rumrux
XcitiumMalware@#2zbwi23zc3h1e
ArcabitAdware.Heur.bmOfNGMkbyp
ViRobotTrojan.Win32.A.PSW-Rumrux.16896.F[UPX]
ZoneAlarmTrojan-PSW.Win32.Rumrux.ak
MicrosoftPWS:Win32/Agent
VaristW32/PWS.DPZZ-3318
AhnLab-V3Trojan/Win32.Xema.C319212
McAfeeGeneric PWS.il
TACHYONTrojan-PWS/W32.Rumrux.53248
PandaTrj/Lineage.BRZ
TrendMicro-HouseCallTROJ_AGENT.WST
RisingTrojan.Win32.Rumrux.a (CLASSIC)
YandexTrojan.GenAsa!+eu1FCS1Lnk
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Agent.KV!tr
BitDefenderThetaGen:NN.ZedlaF.36744.bmOfaGMkbyp
AVGWin32:Agent-DHX [Trj]
DeepInstinctMALICIOUS

How to remove PWS:Win32/Agent?

PWS:Win32/Agent removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment