Trojan.AgentPMF.S26388988 removal tips

The Trojan.AgentPMF.S26388988 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.AgentPMF.S26388988 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Xhosa
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Enumerates services, possibly for anti-virtualization
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• CAPE detected the Tofsee malware family
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Trojan.AgentPMF.S26388988?

File Info:
name: 42509982056FCFE092BC.mlw
path: /opt/CAPEv2/storage/binaries/404fb684a2ec5d4513ef5d48f1e4ea8a07aaa44df1a3629c73d4f281b45738ca
crc32: 4FE32276
md5: 42509982056fcfe092bc52ea101ff5c6
sha1: fd10c320d26cbbe14faf32390e9c0760a6eb3882
sha256: 404fb684a2ec5d4513ef5d48f1e4ea8a07aaa44df1a3629c73d4f281b45738ca
sha512: bd8c6d841fbf3e8aca1052ea9ca0eeb24a958854c3fe4cb8f067d9e3259d92c88e6efbc9dcfa602b47b330a295d0b31df1d59d05061639f644ebae41e4e33676
ssdeep: 49152:zixCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCP:zi
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1ABB69EB47AB1A556D55523B0D91B8FD21EACBCC46C48874760BB2B8AFEE7340185332F
sha3_384: 4c91f596587a0ef23c0fb5d99b9036b9d55e1f8b1b5bb409490be9b78da8fcbf839c450b883710f79987d956e84d335a
ep_bytes: e8c1490000e978feffff832564d64300
timestamp: 2020-09-01 12:27:37

Version Info:
FileVersion: 21.29.11.69
InternationalName: bomgveoci.iwa
Copyright: Copyrighz (C) 2021, fudkorta
ProjectVersion: 1.10.74.57
Translations: 0x0121 0x03ca

Trojan.AgentPMF.S26388988 also known as:

How to remove Trojan.AgentPMF.S26388988?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.