Rootkit.Win32.Agent.emte (file analysis)

The Rootkit.Win32.Agent.emte is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Rootkit.Win32.Agent.emte virus can do?

• Performs HTTP requests potentially not found in PCAP.
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Attempts to modify proxy settings
• Attempts to interact with an Alternate Data Stream (ADS)
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Rootkit.Win32.Agent.emte?

File Info:
name: FB0C356756EF7714A4F9.mlw
path: /opt/CAPEv2/storage/binaries/bfeaa7f6b62b41ce462bcb8d0ec8f2a4f1ddcc029b4f9836af9c7e6248db647c
crc32: 06960AEE
md5: fb0c356756ef7714a4f96e5fc20fcd30
sha1: a4bf23d601b92369487df6d836611d8f636b8caf
sha256: bfeaa7f6b62b41ce462bcb8d0ec8f2a4f1ddcc029b4f9836af9c7e6248db647c
sha512: c65970fa5d782338c7d808e2645b2a67095d42d6ece3536db10c2b02bc8358afb6fd8eb8e5b15571f482d3f81faa058fe2ba4ae05701925d621c06975973b86d
ssdeep: 49152:zqwCjkrmFhH7cwd4CA2j3x5dUIeZbIJIJraelh:zYw2sCPjrdn+b7Jra
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T140A5330FB57584D9FD866CFB180B96DA235968965C01F49E4E42CBD71CFAAE0A402F33
sha3_384: 8224df73cdcc2d3bd8bbe88b2accb3c590a4ab402eb73fa724a019d5241e405332c18dd57a94158f23daa6bf0fa18e9a
ep_bytes: 60be00d061008dbe0040deff5783cdff
timestamp: 2014-04-04 13:12:49

Version Info:
FileVersion: 2.1.0.3
FileDescription: 易语言程序
ProductName: 盒子助手
ProductVersion: 2.1.0.3
CompanyName: 舒克
LegalCopyright: 舒克 版权所有
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
Translation: 0x0804 0x04b0

Rootkit.Win32.Agent.emte also known as:

How to remove Rootkit.Win32.Agent.emte?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.