Trojan

Trojan.AutoIT.Agent.AAF removal guide

Malware Removal

The Trojan.AutoIT.Agent.AAF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.AutoIT.Agent.AAF virus can do?

  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Reads data out of its own binary image
  • A process created a hidden window
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial binary language: Russian
  • The binary likely contains encrypted or compressed data.
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Executed a process and injected code into it, probably while unpacking
  • Steals private information from local Internet browsers
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

Related domains:

430lodsposlok.monster

How to determine Trojan.AutoIT.Agent.AAF?


File Info:

crc32: 5BEBA73E
md5: 53119f69f357a070af352693323e9f33
name: 53119F69F357A070AF352693323E9F33.mlw
sha1: 4f3c0c1218e937db2d1c02b36e17aecfff08cbce
sha256: 3eb24bbe1ee3e304a99486d0857ff1c1160554513c893fd8e4534a869fcf73ce
sha512: 01f0e1820303d332c032c0dfac66dd3dacd544e6120d96635034354f66efecfafffd2035baa91599f57b02ca54c39751001509fd170a4153f401c64fbffa8a88
ssdeep: 98304:iUAckh+/qD6NJIQmEvIAdwja7bOtOKeGk0DORXLD:iUB9/nLmtaHOtObGk8EXLD
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Biolparetos Software
InternalName: Art_1.exe
FileVersion: 97.84.45.21
CompanyName: Biolparetos Software
PrivateBuild:
LegalTrademarks:
Comments: Biolparetos Software
ProductName: Biolparetos Software
SpecialBuild:
ProductVersion: 97.84.45.21
FileDescription: Biolparetos Software
OriginalFilename: Art_1.exe
Translation: 0x0419 0x04b0

Trojan.AutoIT.Agent.AAF also known as:

BkavW32.AIDetectVM.malware1
MicroWorld-eScanTrojan.AutoIT.Agent.AAF
ALYacTrojan.AutoIT.Agent.AAF
SangforMalware
BitDefenderTrojan.AutoIT.Agent.AAF
APEXMalicious
ClamAVWin.Malware.Azorult-9776568-0
KasperskyTrojan.Win32.Autoit.for
Ad-AwareTrojan.AutoIT.Agent.AAF
FireEyeGeneric.mg.53119f69f357a070
EmsisoftTrojan.AutoIT.Agent.AAF (B)
IkarusTrojan.Win32.Autoit
JiangminTrojan.Miner.ffr
WebrootW32.Malware.Gen
AviraHEUR/AGEN.1123658
MicrosoftTrojan:Win32/Wacatac.C!ml
ArcabitTrojan.AutoIT.Agent.AAF
ZoneAlarmTrojan.Win32.Autoit.for
GDataGen:Heur.PHS.1 (3x)
CynetMalicious (score: 85)
ESET-NOD32Win32/Autoit.OJO
MAXmalware (ai score=88)
YandexTrojan.PWS.Azorult!aUBuO8qozcI
SentinelOneStatic AI – Suspicious PE
eGambitPE.Heur.InvalidSig
Qihoo-360HEUR/QVM20.1.44A7.Malware.Gen

How to remove Trojan.AutoIT.Agent.AAF?

Trojan.AutoIT.Agent.AAF removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment