Trojan.Agent.FGKR (file analysis)

The Trojan.Agent.FGKR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.FGKR virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Trojan.Agent.FGKR?

File Info:
name: 7D09EB02D8F3227F98A9.mlw
path: /opt/CAPEv2/storage/binaries/71371ca6a8ea6b05db487f26c2cf3bed1f22e546e62a089e093cd8781ee7b911
crc32: 73AC689C
md5: 7d09eb02d8f3227f98a923e39db6190e
sha1: 00d66b9c97fd371ada778411e2b8672180ef2420
sha256: 71371ca6a8ea6b05db487f26c2cf3bed1f22e546e62a089e093cd8781ee7b911
sha512: e08632da1ac8a3dfa120ef5b663bb29b85735f771375c33addebb14d0f68e221507fc4a996da82195db61de7d3b37176224c6b2fe1d219c54edf6027af0bb2e1
ssdeep: 3072:L5RnXCtli6MJ993P31tHsiduMMLL9DMkDzK8Wzukjkhj8F2:FRQUJ9p9BzwZBMkDzK8kDjkhj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E8E30252A7780560E0ED7238926EDF3B832BED0967FCA180937B6F1ABC37894522051D
sha3_384: cbdbbff9905f5bb68b5eaaab317f8d7e979c0a39fdfb05b12e33e302f7ace708c562ef50355de15a3e27990a19636733
ep_bytes: 60be15d070008dbeeb3fcfff57eb0b90
timestamp: 2005-12-16 08:27:41

Version Info:
CompanyName: Bsgojqw Pxcxt
FileDescription: Bsgojqw Gxrntfagkd Fpkuy
FileVersion: 33, 36, 72, 95
InternalName: Bsgojqw
LegalCopyright: Copyright © Bsgojqw Pxcxt 2002-2005
OriginalFilename: Bsgojqw.exe
ProductName: Bsgojqw Gxrntfagkd Fpkuy
ProductVersion: 39, 36, 27, 22
Translation: 0x0409 0x04e4

Trojan.Agent.FGKR also known as:

How to remove Trojan.Agent.FGKR?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.