About “Python/PSW.Agent.PR” infection

The Python/PSW.Agent.PR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Python/PSW.Agent.PR virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Created a process from a suspicious location
• CAPE detected the PyInstaller malware family

How to determine Python/PSW.Agent.PR?

File Info:
name: 21742AE7A346D62311BD.mlw
path: /opt/CAPEv2/storage/binaries/72f6e856ac8db05b842701ebe31b36bc4880b9dc0cdca73031b97fb4b377d69c
crc32: FA1CCE4F
md5: 21742ae7a346d62311bdc742d616017a
sha1: 117c3e1b9e246837ac78858026e9345dfe62c03b
sha256: 72f6e856ac8db05b842701ebe31b36bc4880b9dc0cdca73031b97fb4b377d69c
sha512: 2b4c3d9ed2820f4664412f2cf4b4c2c7eb4c74c7d28cc2e2c38fe79c27bd30c3839a619f70b24ab9157387e1972653e2e73aa1e0c5d2e4bb05bf3a6678384bee
ssdeep: 196608:Zv24VhMuWJysVYvsOIVoyMxxvjDDAxRaT35SNm+Tyww2:BVHWJnoyMxtDDAxGJShyH2
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T1BB76335463505AD8F2F35035DCA40426E6B3F4260B15509743A0AB37AF53BF2AEBCBB6
sha3_384: cd9d0d281f22bba2da28f9bcf62e6c893ccf716aaced39ea3b6f073946f91ea72f747c8e3ad9cb7c81f6edcfb2b23b38
ep_bytes: 4883ec28e84f0500004883c428e982fe
timestamp: 2020-01-05 12:15:46

Version Info:
0: [No Data]

Python/PSW.Agent.PR also known as:

How to remove Python/PSW.Agent.PR?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.