About “Trojan.Delf.Agent.AH (B)” infection

The Trojan.Delf.Agent.AH (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Delf.Agent.AH (B) virus can do?

The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan.Delf.Agent.AH (B)?


File Info:
name: 0416F07F740107D254B4.mlw
path: /opt/CAPEv2/storage/binaries/8db6785816aaa78fe1f3e34c30b61717c0f6168574a0851bed0496556982451e
crc32: 2856923E
md5: 0416f07f740107d254b4052ebae8f2ed
sha1: c2d936dc9b43d1a2a858d8844769bccd7603c53a
sha256: 8db6785816aaa78fe1f3e34c30b61717c0f6168574a0851bed0496556982451e
sha512: 3f43fd9b7d85f3baed939ebcc1943a3ecf5ef21b14a9d57294eddb264b5a3a0ddf8016bec5d3d2c49bafcf7d41e1196dc3677b487d86dd9a6844ddfbe635d4c7
ssdeep: 768:9MuijtHfPN8m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGF:WNPpsq+QV4rObAdXWpf/y+wozHk+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T118648C11B3D05577E1326A7CED295128A07D3D323FB29849EAF46F0E8CB62D207CA257
sha3_384: b781281521c4be2b269007b36298ee75722b720298938980f9c3f1ca903fe58c90c11d967b0dcf6a543d951c904e7925
ep_bytes: 60be004004108dbe00d0fbff5783cdff
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Trojan.Delf.Agent.AH (B) also known as:

Bkav	W32.AIDetect.malware1
MicroWorld-eScan	Trojan.Delf.Agent.AH
FireEye	Generic.mg.0416f07f740107d2
CAT-QuickHeal	Backdoor.Xtrat.S134532
ALYac	Trojan.Delf.Agent.AH
Malwarebytes	Trojan.Agent
K7AntiVirus	Trojan ( 004bcce41 )
K7GW	Trojan ( 004bcce41 )
Cybereason	malicious.f74010
Baidu	Win32.Backdoor.Agent.ag
Cyren	W32/Xtrat.B.gen!Eldorado
Symantec	SMG.Heur!gen
ESET-NOD32	a variant of Win32/AutoRun.Remtasu.E
APEX	Malicious
ClamAV	Win.Trojan.Keylogger-192
Kaspersky	VHO:Backdoor.Win32.Xtreme.gen
BitDefender	Trojan.Delf.Agent.AH
Avast	Win32:AutoRun-CCW [Wrm]
Tencent	Trojan.Win32.Injector.r
Ad-Aware	Trojan.Delf.Agent.AH
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.Kryptik.BTN@4q3gvq
DrWeb	Trojan.DownLoader22.2485
VIPRE	Trojan.Win32.Xpack.a (v)
McAfee-GW-Edition	BehavesLike.Win32.HLLP.fz
Emsisoft	Trojan.Delf.Agent.AH (B)
Ikarus	Trojan.SuspectCRC
GData	Win32.Backdoor.Xtrat.L
Jiangmin	TrojanSpy.Keylogger.grj
Avira	BDS/Xtrat.ablv
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Injector.R5297
Acronis	suspicious
McAfee	BackDoor-FAJ
MAX	malware (ai score=80)
Rising	Backdoor.Xtrat!1.6A25 (CLASSIC)
SentinelOne	Static AI – Malicious PE
eGambit	RAT.Xtreme
Fortinet	W32/Generic.AC.2A86!tr
BitDefenderTheta	Gen:NN.ZelphiF.34062.tmW@aWv2fk
AVG	Win32:AutoRun-CCW [Wrm]
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Trojan.Delf.Agent.AH (B)?

Trojan.Delf.Agent.AH (B) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X