Trojan

Trojan.Agent.EFYN removal tips

Malware Removal

The Trojan.Agent.EFYN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Agent.EFYN virus can do?

  • Attempts to connect to a dead IP:Port (1 unique times)
  • Starts servers listening on 0.0.0.0:22837
  • Drops a binary and executes it
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Looks up the external IP address
  • Sniffs keystrokes
  • Attempts to stop active services
  • A process attempted to delay the analysis task by a long amount of time.
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Creates a hidden or system file
  • Creates a copy of itself
  • Attempts to disable UAC
  • Attempts to modify UAC prompt behavior

Related domains:

z.whorecord.xyz
a.tomx.xyz
whatismyipaddress.com
www.showmyipaddress.com
whatismyip.everdot.org
www.whatismyip.ca
ysdtgab.net
fxhqbrekie.net
iweihmuoy.info
vzlkxcntr.net
cmeiwptbfl.net
bnbqkccka.net
mnmliwnyek.info
dufdwmuep.org
lugnkniejs.net
ehztwatjku.info
qcgmcuwkciuo.com
eanhlzr.net
pdtdrlswhzpi.info
vvujdgejtkfz.info
dutwnhhnl.net
bfpycbf.org
eiqfblnup.info
hgjmbwngqqr.net
pkxgngg.net
jeqezwfmvff.info
hkhengv.info
wricpbyj.net
rozstlfnzkh.net
oswamk.org
zzzamdowdgfc.net
movfreoydm.net
hjretbse.net
bsembgzol.net
osciyyuews.com
fsrjzemc.info
ryzppuxlkzh.info
hojqjb.info
ulbbgwghfj.net
ddbararqkmgr.info
xgjqrmcif.com
saisciwsosiu.com
jvfihjbcrlhb.info
tzsbjcccjwu.com
dagfpebb.info
wdgqjygin.info
mexbfijiok.net
opylqcrsbxhf.net
cqkycxrsxmm.info
ymqkjynmb.info
eonunxddhucu.net
aigiewkw.com
dsjjfaa.info
cufghynd.info
qihmmc.info
rgffudhud.info
asuqowsw.com
boyrohljblbp.net
dqprwmkh.net

How to determine Trojan.Agent.EFYN?


File Info:

crc32: 77D41A61
md5: 47183530ccd81db32c92aa5156d0049e
name: 47183530CCD81DB32C92AA5156D0049E.mlw
sha1: 3701b5a50adbcffcd200658f629bcb4db7ea39cc
sha256: dc3149de3818f0c513d633fbb9d4544da845caa01a36b65727fff16c6ef43fe2
sha512: e6d4cdf9696097859d085e800d5c2c81f48b93e24bce27b3fa95ca570ae1d42dcca91f6eb4cd51b13f470407b1f3327f3760159e0a3dcb8fc3cfa17c483b5c18
ssdeep: 6144:G1Qv8rK3FQp4LGCr9a9n4FRm6RGMXKqCQFHgTH86JQPDHDdx/Qtqa:DOkiCpat4FU6JXKqFZgHPJQPDHvd
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Trojan.Agent.EFYN also known as:

BkavW32.FamVT.Blocker3TTc.Worm
K7AntiVirusTrojan ( 003da8d71 )
Elasticmalicious (high confidence)
DrWebTrojan.Siggen.36621
CynetMalicious (score: 100)
CAT-QuickHealTrojan.Mauvaise.SL1
ALYacTrojan.Agent.EFYN
CylanceUnsafe
ZillyaTrojan.Blocker.Win32.40256
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaRansom:Win32/Blocker.2ffc5dcf
K7GWTrojan ( 003da8d71 )
Cybereasonmalicious.0ccd81
BaiduWin32.Worm.Autorun.o
CyrenW32/Pykspa.A.gen!Eldorado
SymantecW32.Pykspa.D
ESET-NOD32Win32/AutoRun.Agent.TG
ZonerTrojan.Win32.24407
APEXMalicious
AvastWin32:Renos-KY [Trj]
ClamAVWin.Worm.Pykspa-6057105-0
KasperskyTrojan-Ransom.Win32.Blocker.jcen
BitDefenderTrojan.Agent.EFYN
NANO-AntivirusTrojan.Win32.TrjGen.dxqwva
ViRobotTrojan.Win32.Blocker.Gen.B
SUPERAntiSpywareWorm.SkypeBot
MicroWorld-eScanTrojan.Agent.EFYN
TencentWorm.Win32.Pykspa.a
Ad-AwareTrojan.Agent.EFYN
SophosML/PE-A + W32/Pykse-F
ComodoWorm.Win32.Autorun.Agent_TG0@1isiwy
BitDefenderThetaGen:NN.ZexaF.34688.qnW@a0gTKuf
VIPREWorm.Win32.Skyper.b (v)
TrendMicroWORM_VILSEL.SMC
McAfee-GW-EditionBehavesLike.Win32.Pykse.tz
FireEyeGeneric.mg.47183530ccd81db3
EmsisoftTrojan.Agent.EFYN (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan/Blocker.lia
WebrootWorm:Win32/Pykspa.C
AviraTR/Agent.327680.A
eGambitUnsafe.AI_Score_100%
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftWorm:Win32/Pykspa.C
AegisLabTrojan.Win32.Blocker.tpVI
ZoneAlarmTrojan-Ransom.Win32.Blocker.jcen
GDataTrojan.Agent.EFYN
TACHYONTrojan/W32.Blocker.1314816.F
AhnLab-V3Trojan/Win32.Zepfod.R397
Acronissuspicious
McAfeeW32/Pykse.worm.gen.a
MAXmalware (ai score=83)
VBA32Trojan.ChidikSun.28205
MalwarebytesGeneric.Worm.Agent.DDS
PandaTrj/Genetic.gen
TrendMicro-HouseCallWORM_VILSEL.SMC
RisingWorm.Autorun!1.BC87 (CLOUD)
YandexTrojan.GenAsa!R41E4MI3PTc
IkarusTrojan.Win32.AntiAV
MaxSecureTrojan.Ransom.Blocker.iprw
FortinetW32/Agent.XEK!tr
AVGWin32:Renos-KY [Trj]
Paloaltogeneric.ml

How to remove Trojan.Agent.EFYN?

Trojan.Agent.EFYN removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment