Categories: Malware

Troj/AutoG-IK removal

The Troj/AutoG-IK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Troj/AutoG-IK virus can do?

Executable code extraction
Possible date expiration check, exits too soon after checking local time
Creates RWX memory
Unconventionial language used in binary resources: Korean
The binary likely contains encrypted or compressed data.
Deletes its original binary from disk
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Creates known PcClient mutex and/or file changes.

Related domains:

z.whorecord.xyz

a.tomx.xyz

2.tcp.ngrok.io

How to determine Troj/AutoG-IK?


File Info:
crc32: A5733C47md5: d1df2c0089b125cdd71bd5735739ed57name: mozillats.exesha1: a31ba985783696bea6499491d8e4fd762e448216sha256: af41272c4f2026f6f0b2299ad9410157c7ed9b8321ee9e482145ef7784dbb1ccsha512: 143221e7bfe37ae38dc6581315b1b5f6398ec559ffd3d3a8223b88a648517d34100d03187006b284a85db7fb546201e163068d118f03e2fb99cebc993784be7cssdeep: 3072:pm2t+PdK2H+hQaRMlwtrMQbYn7HorFfUUCWjLH+478PFw1o00MG:pmpVKgaRMlxUfhjSU8PUn0MGtype: MS-DOS executable, MZ for MS-DOS
Version Info:
0: [No Data]

Troj/AutoG-IK also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.Spyrat.1
FireEye	Generic.mg.d1df2c0089b125cd
CAT-QuickHeal	Backdoor.Farfli.O
Qihoo-360	HEUR/QVM18.1.3987.Malware.Gen
McAfee	GenericRXAA-AA!D1DF2C0089B1
Cylance	Unsafe
VIPRE	Trojan.Win32.Redosdru.C (v)
BitDefender	Gen:Heur.Spyrat.1
Cybereason	malicious.089b12
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZexaF.34152.imqaaiDSlXeG
F-Prot	W32/Farfli.BB.gen!Eldorado
Symantec	Backdoor.Trojan
Baidu	Win32.Trojan.Farfli.ap
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
Tencent	Malware.Win32.Gencirc.10b752bd
Ad-Aware	Gen:Heur.Spyrat.1
Comodo	TrojWare.Win32.Farfli.LK@4pmigc
F-Secure	Backdoor.BDS/Farfli.kj.2
DrWeb	Trojan.KeyLogger.28570
TrendMicro	BKDR_FARFLI.SMK
Sophos	Troj/AutoG-IK
Ikarus	Trojan.Win32.Farfli
Cyren	W32/Farfli.BB.gen!Eldorado
Jiangmin	Trojan.Generic.bsivi
Avira	BDS/Farfli.kj.2
Fortinet	W32/Farfli.AIL!tr
Antiy-AVL	Trojan/Win32.AGeneric
Arcabit	Trojan.Spyrat.1
AhnLab-V3	Backdoor/Win32.RL_Farfli.R302170
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Backdoor:Win32/PcClient.ZR
Cynet	Malicious (score: 100)
ESET-NOD32	a variant of Win32/Farfli.BBM
Acronis	suspicious
VBA32	BScope.Backdoor.Spy
ALYac	Gen:Heur.Spyrat.1
MAX	malware (ai score=80)
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	BKDR_FARFLI.SMK
Rising	Malware.Heuristic!ET#83% (RDMK:cmRtazocw6E+moqqFPJzrIAjoQoi)
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_97%
GData	Gen:Heur.Spyrat.1
AVG	Win32:Farfli-AX [Trj]
Avast	Win32:Farfli-AX [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
MaxSecure	Trojan.Malware.300983.susgen