Trojan.Agent.DLMO removal tips

The Trojan.Agent.DLMO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.DLMO virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Access the NetLogon registry key, potentially used for discovery or tampering
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Tries to unhook or modify Windows functions monitored by Cuckoo
• CAPE detected the IcedID malware family
• Created network traffic indicative of malicious activity

Related domains:

How to determine Trojan.Agent.DLMO?

File Info:
name: 5AC511DBEFA43F0161CC.mlw
path: /opt/CAPEv2/storage/binaries/af006d9949cb74dbc3369c1c3e6e0f67c388889529f36a0f7bd5bcac2db67fc7
crc32: E6ED8419
md5: 5ac511dbefa43f0161cc00b4ae8673bd
sha1: ffffc0a8f3b9e90f9a4f9e47f773c0097ab3fdf4
sha256: af006d9949cb74dbc3369c1c3e6e0f67c388889529f36a0f7bd5bcac2db67fc7
sha512: e9e01edf83d16922f9499a9536fc5dd2408db6b4a06b5a225a832c95dbdd7d66913dafdd3e796a67f08eb127acf65f0240fea4637661324939f283875433bf74
ssdeep: 6144:aqfAdyPGgfzQtHAfbvUO0D3am+VQ/VuXXIg6Df23HWZ:aqfAYPXQtHjDam+V0WIg6Ds2Z
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A484AE1175549052D04A97328B76E871950E7E26A328A8AE32F07F1F3B78DD3463FB2D
sha3_384: 672af51abf1ffa6564c3fbf7e51183290f016c4d54965a6b7dc3739ec1febd51f7a731f980b6932c72c814df2ab93cf8
ep_bytes: e81f410000e978feffff8bff566a0168
timestamp: 2010-12-12 12:33:01

Version Info:
CompanyName: Bomgar Bank
ProductVersion: 2.0.84.82
ProductName: Centurysun
LegalCopyright: Copyright © 2006 Bomgar Bank. All rights reserved
FileDescription: Centurysun
FileVersion: 2.0.84.82
InternalName: Centurysun
Translation: 0x0409 0x04b0

Trojan.Agent.DLMO also known as:

How to remove Trojan.Agent.DLMO?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.