Trojan

Trojan-PSW.Win32.Agent.tnqs removal tips

Malware Removal

The Trojan-PSW.Win32.Agent.tnqs is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan-PSW.Win32.Agent.tnqs virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Possible date expiration check, exits too soon after checking local time
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (23 unique times)
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • A named pipe was used for inter-process communication
  • Starts servers listening on 0.0.0.0:0
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Looks up the external IP address
  • Executed a very long command line or script command which may be indicative of chained commands or obfuscation
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Detects Sandboxie through the presence of a library
  • Detects Avast Antivirus through the presence of a library
  • Executed a process and injected code into it, probably while unpacking
  • Checks for the presence of known windows from debuggers and forensic tools
  • Attempts to execute a binary from a dead or sinkholed URL
  • Steals private information from local Internet browsers
  • Network activity contains more than one unique useragent.
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Creates a hidden or system file
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Detects VMware through the presence of a registry key
  • Attempts to modify proxy settings
  • Attempts to disable Windows Defender
  • Attempts to create or modify system certificates
  • Collects information to fingerprint the system
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz
a.goatgame.co
sornx.xyz
cdn.discordapp.com
ocsp.digicert.com
the-flash-man.com
ipinfo.io
privacytoolz123foryou.xyz
i.spesgrt.com
aa.goatgamea.com
553835e4-8579-4eef-9487-08e116066fe4.s3.amazonaws.com
bewidog.cz
apps.identrust.com
telegram.org
twitter.com
yandex.ru
telete.in
crl.identrust.com
eduarroma.tumblr.com
cleaner-partners.biz
ocsp.comodoca.com
ocsp.usertrust.com
ocsp.sectigo.com
iplis.ru
iplogger.org
kipriauka.tumblr.com
connectini.net
g.symcd.com
ss.symcd.com
nybhfe02.top
proxycheck.io
hypercustom.top

How to determine Trojan-PSW.Win32.Agent.tnqs?


File Info:

crc32: 8B4258B9
md5: 6845d02328fb5e5e5944acd141d2b088
name: 6845D02328FB5E5E5944ACD141D2B088.mlw
sha1: 5d04f7bbd56dd67612d79a6fbcfddb1888cd1c8e
sha256: 45c04168fe1e27939f2e08c178279d8c1aca5eba4ed8f6a717eb70b966cc5617
sha512: 4e81fd2117635ecefb2943953e805cbe2416c98b75c40d421dd7f13e3f014d7941bea24820b9359cd5c1fcb18043c8ca688e5bd171ee029b651157d39d02eb4b
ssdeep: 49152:9gBjHAC8QDo0NcMpwz+Qern2gMA9q9GABB3rI+vylIeRt9ipgJ:yhHA2caIzdernXJq9FJeRypgJ
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:

0: [No Data]

Trojan-PSW.Win32.Agent.tnqs also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Agent.i!c
Elasticmalicious (high confidence)
DrWebTrojan.Siggen14.58048
CynetMalicious (score: 100)
CAT-QuickHealTrojan.Win32
ALYacDropped:Trojan.GenericKD.46876098
CylanceUnsafe
SangforInfostealer.Win32.Agent.tnqs
AlibabaTrojanDownloader:Win32/Miner.4aaa924c
Cybereasonmalicious.bd56dd
CyrenW32/MSIL_Kryptik.EHH.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32multiple detections
APEXMalicious
AvastWin64:Trojan-gen
ClamAVWin.Dropper.Pswtool-9857535-0
KasperskyTrojan-PSW.Win32.Agent.tnqs
BitDefenderDropped:Trojan.GenericKD.46876098
NANO-AntivirusTrojan.Win64.Download.izkmfm
MicroWorld-eScanDropped:Trojan.GenericKD.46876098
SophosMal/Generic-S
BitDefenderThetaGen:NN.ZemsilF.34110.am0@aq6M1jm
TrendMicroRansom_HPGANDCRAB.SMONT2
McAfee-GW-EditionBehavesLike.Win32.BadFile.vc
FireEyeGeneric.mg.6845d02328fb5e5e
EmsisoftDropped:Trojan.GenericKD.46876098 (B)
SentinelOneStatic AI – Malicious PE
WebrootW32.Trojan.Gen
AviraHEUR/AGEN.1144141
eGambitUnsafe.AI_Score_99%
Antiy-AVLTrojan/Generic.ASMalwS.3454962
KingsoftWin32.Troj.Generic_a.a.(kcloud)
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
GridinsoftTrojan.Win32.Dropper.ko!s5
GDataDropped:Trojan.GenericKD.46876098
AhnLab-V3Ransomware/Win.Hpgandcrab.C4612753
McAfeeArtemis!6845D02328FB
MAXmalware (ai score=84)
VBA32TScope.Trojan.MSIL
MalwarebytesTrojan.Downloader
PandaTrj/CI.A
TrendMicro-HouseCallRansom_HPGANDCRAB.SMONT2
RisingDropper.Agent/NSIS!1.D805 (CLASSIC:gjVFJO3a0/MRKpk5+DudGg)
IkarusTrojan-Downloader.Win64.Agent
FortinetW64/Agent.LI!tr.dldr
AVGWin64:Trojan-gen
Paloaltogeneric.ml

How to remove Trojan-PSW.Win32.Agent.tnqs?

Trojan-PSW.Win32.Agent.tnqs removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment