Categories: Trojan

Trojan.Agent.DRPR (file analysis)

The Trojan.Agent.DRPR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.DRPR virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Trojan.Agent.DRPR?


File Info:
name: EDE1F1265D62E68D00A9.mlwpath: /opt/CAPEv2/storage/binaries/4032eeae4fe5e03b16556006b30f0f9d18a2ddfe18d790d8d845d78fb0ba098acrc32: C1F86C6Fmd5: ede1f1265d62e68d00a9c27e6774049fsha1: da5464ab14c8f2d99e404cea6f016181823c3ee2sha256: 4032eeae4fe5e03b16556006b30f0f9d18a2ddfe18d790d8d845d78fb0ba098asha512: fef97a298f0b335e29da806280ca1f2fda75d156654e598333a6e14b31a8b28257707f270baae2e5ce64069127f90e1998b3034ccee978f4752ebcfd95172ec7ssdeep: 6144:KvfTFbPtIeJHj+riaTA3ucEorQexqsEPvOS+qjtbIHdkVK4:uT1PtIeJD2bT3C0extg2SrUdkttype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D0948C08B6824872EA560A724A736F24D737BD9F9B718DB722D33FF97A310816523513sha3_384: 98721c1512f60694fc5166c6b811a192f85e90a54ad08c054f626f7b2c4c1d181ef60a64a6352d449409b78117905625ep_bytes: e8b27a0000e9000000006a1468a82e42timestamp: 2019-03-17 02:52:57
Version Info:
FileVersion: 4.7.8.6FileDescription: Lckdiscard Wherever Unique EvaluatedLegalCopyright: Copyright ©Softline 2016  All rights reserved.LegalTrademarks: Copyright ©Softline 2016  All rights reserved.OriginalFilename: Inode.exeCompanyName: SoftlineProductName: InodeProductVersion: 4.7.8.6Translation: 0x0409 0x04b0

Trojan.Agent.DRPR also known as:

Bkav	W32.SieofsuTNAD.Trojan
Lionic	Trojan.Win32.Yakes.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Agent.DRPR
CAT-QuickHeal	Trojan.Mauvaise.SL1
McAfee	Artemis!EDE1F1265D62
Cylance	Unsafe
Zillya	Trojan.Yakes.Win32.72315
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0054a14b1 )
Alibaba	Trojan:Win32/Yakes.1a5f83b8
K7GW	Trojan ( 0054a14b1 )
CrowdStrike	win/malicious_confidence_100% (D)
ESET-NOD32	a variant of Win32/Kryptik.GQZA
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Yakes.ymqk
BitDefender	Trojan.Agent.DRPR
NANO-Antivirus	Trojan.Win32.Yakes.fodnhi
Rising	Trojan.Generic@ML.97 (RDMK:LiIo/1Gz6eKRT9WYBIAf5Q)
Ad-Aware	Trojan.Agent.DRPR
Sophos	Mal/Generic-S
Comodo	Malware@#23n4wew5lmxht
DrWeb	Trojan.Inject3.15863
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Emotet.gc
FireEye	Generic.mg.ede1f1265d62e68d
Emsisoft	Trojan.Agent.DRPR (B)
Ikarus	Trojan-Ransom.GandCrab
GData	Trojan.Agent.DRPR
Jiangmin	Trojan.Yakes.aeay
eGambit	Unsafe.AI_Score_99%
Avira	HEUR/AGEN.1128655
Antiy-AVL	Trojan/Generic.ASMalwS.2AEE1A5
Microsoft	Trojan:Win32/Occamy.C40
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Yakes.C3111590
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34294.zq0@aW9uGmbi
ALYac	Trojan.Agent.DRPR
MAX	malware (ai score=85)
VBA32	BScope.Trojan.Propagate
Malwarebytes	Trojan.Injector
Tencent	Malware.Win32.Gencirc.116acf6e
Yandex	Trojan.Yakes!emRz1P0EcRw
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W32/Generik.MAAMXR!tr
Cybereason	malicious.65d62e
Panda	Trj/CI.A