Categories: Trojan

Trojan.Agent.DFRT (file analysis)

The Trojan.Agent.DFRT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.DFRT virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Attempts to identify installed AV products by registry key
Anomalous binary characteristics

How to determine Trojan.Agent.DFRT?


File Info:
crc32: 0AD51921md5: 668e6523ad7dcdd6cb87b134032924afname: 668E6523AD7DCDD6CB87B134032924AF.mlwsha1: c6991620c8430407dee01cf5c0b61f0c92b5652esha256: 1a2c84660eaca7fc48af35da32d52ce83923891e47eed64f4e0f37b17f420570sha512: 334f61fb038e88e06d61a606b1eb0df5a7c0d65a353e29de807bfe0faf4c7d1318a249fb0f5d85b216f20da25a1340fab85826eac3fbc872483651a4d2a978bcssdeep: 3072:BkLevlPBzeQLwDpiXKXiXKXiXd2lHi0W6/3tIr2y57eVue/mzr5:aLalPBzLGm23u5type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 2005-2013 Nullsoft, Inc.InternalName: feedbackFileVersion: 1, 11, 0, 0CompanyName: Nullsoft, Inc.PrivateBuild: Release|Win32Comments: Winamp Beta ProgramProductName: Winamp Error ReporterBuildNumber: 3516SpecialBuild: 5.6.6, Build 3516 FINAL_2013_1213_022844 ProductVersion: 5.6.6.3516FileDescription: Winamp Error ReporterOriginalFilename: feedback.exeTranslation: 0x0409 0x04b0

Trojan.Agent.DFRT also known as:

K7AntiVirus	Trojan ( 005380741 )
Lionic	Hacktool.Win32.Krap.lKMc
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen7.57381
McAfee	Packed-FIL!668E6523AD7D
Cylance	Unsafe
Zillya	Trojan.Yakes.Win32.69479
Sangfor	Virus.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (D)
Alibaba	Trojan:Win32/Bunitu.ali1000105
K7GW	Trojan ( 005380741 )
Cybereason	malicious.3ad7dc
Cyren	W32/Trojan.BUF.gen!Eldorado
Symantec	Packed.Generic.459
ESET-NOD32	a variant of Win32/Kryptik.GLUW
APEX	Malicious
Avast	Win32:DangerousSig [Trj]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.NetStream.gen
BitDefender	Trojan.Agent.DFRT
NANO-Antivirus	Trojan.Win32.Yakes.fiotwn
MicroWorld-eScan	Trojan.Agent.DFRT
Tencent	Malware.Win32.Gencirc.10ba47fb
Ad-Aware	Trojan.Agent.DFRT
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.TrojanProxy.Bunitu.GITU@7vqd7z
BitDefenderTheta	Gen:NN.ZexaF.34236.Eq1@aqWLtBki
VIPRE	Trojan.Win32.Generic.pak!cobra
TrendMicro	TrojanSpy.Win32.TRICKBOT.SMB.hp
McAfee-GW-Edition	Packed-FIL!668E6523AD7D
FireEye	Generic.mg.668e6523ad7dcdd6
Emsisoft	Trojan.Agent.DFRT (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.NetStream.aon
Avira	TR/Crypt.Agent.zfopk
Antiy-AVL	Trojan/Generic.ASMalwS.283DA84
Microsoft	TrojanProxy:Win32/Bunitu!rfn
GData	Trojan.Agent.DFRT
AhnLab-V3	Trojan/Win.Agent.R363203
Acronis	suspicious
VBA32	BScope.TrojanProxy.Bunitu
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TrojanSpy.Win32.TRICKBOT.SMB.hp
Rising	Trojan.Kryptik!1.B397 (CLASSIC)
Yandex	Trojan.Yakes!v15o9wEgsz0
Ikarus	Trojan.Win32.Crypt
Fortinet	W32/Kryptik.GLWT!tr
AVG	Win32:DangerousSig [Trj]
Paloalto	generic.ml