What is “Trojan.Agent.BLHL”?

The Trojan.Agent.BLHL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.BLHL virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Attempts to connect to a dead IP:Port (52 unique times)
• Dynamic (imported) function loading detected
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)

How to determine Trojan.Agent.BLHL?

File Info:
name: DFA41B28FB0CBC5ABD54.mlw
path: /opt/CAPEv2/storage/binaries/248cd9a79ccfd65a3bfc805ac9b5ccf87f1d6e7e965f9f3ecaad1ea04902ad73
crc32: F7D71479
md5: dfa41b28fb0cbc5abd54cb147f95cd1a
sha1: e8113c511a4b2a77b9a4893cd1086f97248904cf
sha256: 248cd9a79ccfd65a3bfc805ac9b5ccf87f1d6e7e965f9f3ecaad1ea04902ad73
sha512: fb16fa4f8fccf38835288e841ff3e1937b2a369fcdc09f0301e91547ed00ac133e8adaa334559f366f797c3ac8c622cfdd59d1e1285a0172e0d8c87a1d008821
ssdeep: 1536:hUHuEvVuXJyAscVJ7KeLtj1aOZil0YezyRYaX:hUHuEvk/VIQtEO2gsX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18663E085ACA48033D1108738692F473036F8E8B5BF439B4F7575DE9E8E72BA8651A60D
sha3_384: c21edece2dfe039cd19a48295b9feeec219230d33d405af496c16120c7a7af2a2562eaab923499d6ec6082ab0b4de7a8
ep_bytes: 558bec6aff68d026400068a21d400064
timestamp: 2015-07-07 18:27:33

Version Info:
0: [No Data]

Trojan.Agent.BLHL also known as:

How to remove Trojan.Agent.BLHL?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.