What is “Python/Agent.XB”?

The Python/Agent.XB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Python/Agent.XB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Created a process from a suspicious location
• CAPE detected the PyInstaller malware family

How to determine Python/Agent.XB?

File Info:
name: 9C302788972ED63D0679.mlw
path: /opt/CAPEv2/storage/binaries/31350ab8e434be33cc2a06c20e0dcad94c956b605962ecf3cf201c873a935164
crc32: DB5BD6DE
md5: 9c302788972ed63d0679826b8eb4e574
sha1: 87a9b78f5f5d0c5a05620d27173efe9961c7509c
sha256: 31350ab8e434be33cc2a06c20e0dcad94c956b605962ecf3cf201c873a935164
sha512: 136c89c3493e48912b80a3d04066a384e5be949bc9d17589178327b50ae40b533326e0103ce18a5eecd4c860503dcc697fa08a32beebca8bc525d96fe7e0b7bd
ssdeep: 196608:jINbEbGXVFICteEroXxoczlxZV3Gu5D4S26/CS3bt6TTwDD1DR0:ubEeInEroXF14S267t6g9C
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T1D7663314B6E819FAE9BF843AC828C425C2F3B4204390D56F27AC955B4FA76E07D76F44
sha3_384: 9dd69967f14d05d16505c71181a6ef182deb354dd06788434b95985a421f5dbc8ce116b4f9b74317fba12ec711eaecd9
ep_bytes: 4883ec28e8f70400004883c428e97afe
timestamp: 2021-11-09 18:04:01

Version Info:
0: [No Data]

Python/Agent.XB also known as:

How to remove Python/Agent.XB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.