Trojan

How to remove “Trojan.Delf.Agent.LM”?

Malware Removal

The Trojan.Delf.Agent.LM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Delf.Agent.LM virus can do?

  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Executable code extraction
  • Injection with CreateRemoteThread in a remote process
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • Reads data out of its own binary image
  • Unconventionial language used in binary resources: Arabic (Egypt)
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Executed a process and injected code into it, probably while unpacking
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Anomalous binary characteristics

How to determine Trojan.Delf.Agent.LM?


File Info:

crc32: DC59730D
md5: c3ef5eab98d17eb1d45c41ca97e99733
name: vigho.exe
sha1: 5f03b9accfd5037b0794cfb8c33bef6274dc01c0
sha256: 84d416da19fc7995dc9ad82bd0afb2491553f1981b471656df398923674b8444
sha512: 9100e39bfccd2e60a6de2b7eb085a7a5efd2c9b0fc8fe2e258441e78ce4b1cd315cdcc7643613ca9e7bb2fbcfbac3a0e15d2cbd426a7e6d42726e05a4dcc4587
ssdeep: 12288:clXR0az+lf0XNkB0LOb7gIpb2QBeCjojNh/mIXHdZr0PJSI5:clhlxEAe71KQdWh+OrGsI5
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Trojan.Delf.Agent.LM also known as:

MicroWorld-eScanTrojan.Delf.Agent.LM
FireEyeGeneric.mg.c3ef5eab98d17eb1
CAT-QuickHealTrojanspy.Avemaria
McAfeeArtemis!C3EF5EAB98D1
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
K7AntiVirusTrojan ( 00548e841 )
BitDefenderTrojan.Delf.Agent.LM
K7GWTrojan ( 00548e841 )
Cybereasonmalicious.b98d17
Invinceaheuristic
F-ProtW32/Injector.HPT
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Malware-gen
GDataTrojan.Delf.Agent.LM
KasperskyHEUR:Trojan-Spy.Win32.AveMaria.gen
AlibabaTrojanSpy:Win32/Skeeyah.c15aaa7d
NANO-AntivirusTrojan.Win32.AveMaria.fnpibd
AegisLabTrojan.Win32.Lohmys.mxBM
RisingBackdoor.Fynloski!8.1FD (TFE:4:eDtXEpD8ToK)
Ad-AwareTrojan.Delf.Agent.LM
SophosMal/Generic-S
F-SecureTrojan.TR/AD.MortyStealer.wnloh
DrWebTrojan.PWS.Stealer.23680
ZillyaTrojan.AveMaria.Win32.32
TrendMicroTrojanSpy.Win32.AZORULT.SM
McAfee-GW-EditionGenericRXGX-VK!27E18E864479
Trapminesuspicious.low.ml.score
EmsisoftTrojan.Delf.Agent.LM (B)
IkarusTrojan.Inject
CyrenW32/Injector.BLGJ-2687
JiangminTrojanSpy.AveMaria.h
AviraTR/AD.MortyStealer.wnloh
MAXmalware (ai score=100)
Antiy-AVLRiskWare/Win32.DllInject
Endgamemalicious (moderate confidence)
ArcabitTrojan.Delf.Agent.LM
ZoneAlarmHEUR:Trojan-Spy.Win32.AveMaria.gen
MicrosoftTrojan:Win32/Skeeyah.A!rfn
BitDefenderThetaGen:NN.ZelphiF.32250.ImGfaum9YYjG
ALYacTrojan.Delf.Agent.LM
VBA32TrojanSpy.AveMaria
PandaTrj/CI.A
ESET-NOD32a variant of Win32/Injector.EDYY
TrendMicro-HouseCallTrojanSpy.Win32.AZORULT.SM
SentinelOneDFI – Malicious PE
FortinetW32/Injector.ECZY!tr
AVGFileRepMalware
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_80% (W)
Qihoo-360Win32/Trojan.Spy.cd0

How to remove Trojan.Delf.Agent.LM?

Trojan.Delf.Agent.LM removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment