Trojan

Trojan.Agent.NR removal guide

Malware Removal

The Trojan.Agent.NR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Agent.NR virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Detects Sandboxie through the presence of a library
  • Executed a process and injected code into it, probably while unpacking
  • Deletes its original binary from disk
  • Mimics the file times of a Windows system file
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Checks the presence of disk drives in the registry, possibly for anti-virtualization
  • Creates a copy of itself
  • Anomalous binary characteristics

Related domains:

soplifan.ru

How to determine Trojan.Agent.NR?


File Info:

crc32: 09AF86DC
md5: e5f469e21a6800cb4161d659853bd083
name: upload_file
sha1: 77dbe02ee443e51b299dbce4e9efae4f9e64f64e
sha256: bdb217cd1e540b9f8c00136b1d47eb675220194b3aede819208db3aeeda98791
sha512: 3047b85d7c6528d3334f810ceef26e210fa8a64f72737a5358b54701b2f78b238363baaab6de43959eca72e7e71e1caf585873c7ac1d1d164edd70c9ad119f70
ssdeep: 384:TELOTSoMaHAhzQYVu1TY7gKJEmizmzCaF1FY:ZSagh0Qu1UkKE7AF
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Trojan.Agent.NR also known as:

BkavW32.Msbzmu.Trojan
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Ser.Razy.7042
CAT-QuickHealWorm.Gamarue.I1
Qihoo-360HEUR/QVM19.1.A9F7.Malware.Gen
McAfeeW32/Worm-FFE!E5F469E21A68
MalwarebytesTrojan.Agent.NR
VIPRETrojan-Downloader.Win32.Dofoil.a (v)
CrowdStrikewin/malicious_confidence_100% (D)
BitDefenderGen:Variant.Ser.Razy.7042
K7GWTrojan ( 00536d121 )
K7AntiVirusTrojan ( 00536d121 )
ArcabitTrojan.Ser.Razy.D1B82
TrendMicroBKDR_ANDROM.SMV1
CyrenW32/Andromeda.A.gen!Eldorado
SymantecDownloader.Dromedan
APEXMalicious
AvastSf:Citadel-A [Trj]
ClamAVWin.Trojan.Gamarue-6986405-0
KasperskyBackdoor.Win32.Androm.a
NANO-AntivirusVirus.Win32.Gen.ccmw
ViRobotBackdoor.Win32.A.Androm.13824.X
RisingWorm.Win32.Gamarue.b (CLASSIC)
Ad-AwareGen:Variant.Ser.Razy.7042
EmsisoftGen:Variant.Ser.Razy.7042 (B)
ComodoTrojWare.Win32.Kryptik.AFJS@4p06v2
F-SecureWorm.WORM/Gamarue.itza
DrWebBackDoor.Andromeda.22
InvinceaML/PE-A + Troj/Gamarue-AG
McAfee-GW-EditionBehavesLike.Win32.Ardurk.lc
FireEyeGeneric.mg.e5f469e21a6800cb
SophosTroj/Gamarue-AG
IkarusBackdoor.Win32.Androm
JiangminBackdoor/Androm.ag
WebrootW32.Trojan.Dantmil
AviraWORM/Gamarue.itza
MAXmalware (ai score=87)
Antiy-AVLTrojan[Backdoor]/Win32.Androm.a
MicrosoftWorm:Win32/Gamarue.I
SUPERAntiSpywareTrojan.Agent/Gen-Cryptic
ZoneAlarmBackdoor.Win32.Androm.a
GDataGen:Variant.Ser.Razy.7042
CynetMalicious (score: 100)
AhnLab-V3Backdoor/Win32.Androm.R41944
Acronissuspicious
ALYacGen:Variant.Ser.Razy.7042
TACHYONBackdoor/W32.Androm.13824.I
VBA32BScope.Backdoor.Androm
CylanceUnsafe
ESET-NOD32Win32/TrojanDownloader.Wauchos.A
TrendMicro-HouseCallBKDR_ANDROM.SMV1
TencentBackdoor.Win32.Androm.a
SentinelOneDFI – Suspicious PE
eGambitUnsafe.AI_Score_99%
FortinetW32/Citadel.A!tr
BitDefenderThetaAI:Packer.2E3E93F71E
AVGSf:Citadel-A [Trj]
Cybereasonmalicious.21a680
MaxSecureBackdoor.Androm.a

How to remove Trojan.Agent.NR?

Trojan.Agent.NR removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment