Trojan.Agent.CYVK malicious file

The Trojan.Agent.CYVK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.CYVK virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Steals private information from local Internet browsers
• Collects and encrypts information about the computer likely to send to C2 server
• Collects information about installed applications
• Attempts to modify browser security settings
• Harvests credentials from local FTP client softwares
• Collects information to fingerprint the system

How to determine Trojan.Agent.CYVK?

File Info:
name: D138F8F84358A6F3560C.mlw
path: /opt/CAPEv2/storage/binaries/de6fdfe633d1035664178a9932e161b74f25d5fc7f0c874d5a95b044cc2d18c2
crc32: 3753FF16
md5: d138f8f84358a6f3560c5278d839fc50
sha1: 94e241d1b66f56d016cc3faa1f51afd059b94e34
sha256: de6fdfe633d1035664178a9932e161b74f25d5fc7f0c874d5a95b044cc2d18c2
sha512: a3da0fe3a62aa809ca1edae70b152320b7fbb8a4b3b4905359da338c3a6fdf1560e1b46a696f8859bff055f351fac92a0ea982479b322f19a4a82aa0b6fbb067
ssdeep: 6144:7vGh7t2nEpxE9GShCKZAQM7JTpM5Kv3mBQ0HLVccu9:7GhZ2nEngl/ZAQcJ8KvIL
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18194CF112D8D8CB1FCD2C43DDDC085C14819A1608D7EC286FBE7197E2B62DA576EBE62
sha3_384: 6083aae26103039f3b6147cfb1c5883dbe8a2f54995611119284005db1b39d1273d932dcf39b89a0b9df4dd5050b8e3a
ep_bytes: e8753f0000e989feffffc701c0724100
timestamp: 2013-04-03 23:28:02

Version Info:
CompanyName: InDev Inc.
FileDescription: Thumbnail Handler Extraction Host
FileVersion: th
InternalName: pcl
LegalCopyright: Copyright (C) 2009-2012 - InDev Inc.
OriginalFilename: th
ProductName: Thumbnail Handler Extraction Host
ProductVersion: 4.7.2.2
Translation: 0x1009 0x04b0

Trojan.Agent.CYVK also known as:

How to remove Trojan.Agent.CYVK?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.