Trojan.AgentRI.S22827838 (file analysis)

The Trojan.AgentRI.S22827838 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.AgentRI.S22827838 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Dynamic (imported) function loading detected
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Kazak
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Detects Sandboxie through the presence of a library
• Detects Avast Antivirus through the presence of a library
• Checks the presence of disk drives in the registry, possibly for anti-virtualization
• Anomalous binary characteristics

How to determine Trojan.AgentRI.S22827838?

File Info:
name: 8740E3409B8FD2F6542B.mlw
path: /opt/CAPEv2/storage/binaries/a14a96554d527e64804f04ac2715abaca66a1af73c36e3b2da75d975b833026f
crc32: F9ACAE7C
md5: 8740e3409b8fd2f6542bdfdb2a9d3555
sha1: c1bd20daa211d8d0dde555c042812374ef6a89da
sha256: a14a96554d527e64804f04ac2715abaca66a1af73c36e3b2da75d975b833026f
sha512: eb2dfd33d90b1ac63bf1e759a02826087237ae29c3f4d7f75c21124bda539f271397ae935a26ecf155ce9efbd1a2c3d742eae6a9bec5836e8ad1929485abb01e
ssdeep: 6144:1+v74h5AdjXilSnhlsKH17V7SdLPH8d/Nz:8705ApSlOsKH17ZSxEp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10B548C30AAA1C035F9F211F849BA83BDA5393AB16B3440CF53E51AF956386E5EC30757
sha3_384: 6fc6b8d55ffe155af49bcf91100d522ddf7599791908af98ae72f5e8a24022f0369c70fff11230ee91458be061d9dddd
ep_bytes: 8bff558bece8a6980000e8110000005d
timestamp: 2020-04-02 04:54:02

Version Info:
Translation: 0x120a 0x052e

Trojan.AgentRI.S22827838 also known as:

How to remove Trojan.AgentRI.S22827838?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.