Categories: Trojan

Trojan-PSW.Win32.Agent.ze (file analysis)

The Trojan-PSW.Win32.Agent.ze is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-PSW.Win32.Agent.ze virus can do?

Sample contains Overlay data
HTTPS urls from behavior.
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Attempts to modify proxy settings
Harvests credentials from local FTP client softwares
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan-PSW.Win32.Agent.ze?


File Info:
name: F23937FB899F1C5FE2F0.mlwpath: /opt/CAPEv2/storage/binaries/3e222526ca94d9c8d9c05f05ef79ec436f67181fce966bd5e0915a0fc0a6e802crc32: 78A93E19md5: f23937fb899f1c5fe2f0927147f81577sha1: b0bbf4ef81d24b21702d31536e77ec04281d3100sha256: 3e222526ca94d9c8d9c05f05ef79ec436f67181fce966bd5e0915a0fc0a6e802sha512: bc2dcbfb1f7c83c6f3231346239d7f9506a6e18561736df3b7fb4e520a78c34bba19aafa820f81b3f83ec52fa41a55b441f530cb0be1b85f5cced26315f6847fssdeep: 6144:kgTCCraLvD+RFQJJpj1snryP/B+5ZHr6ImqGMGC/B+Bg:kgtaLiRMNhetvvntype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1ACD423D1E8217231CFECE63632342417D8FE6A34E602B716439AC7979E62D93E6D4319sha3_384: 5cf7968176af5fb8190d7e1fa7224a74ce2fcb6c417cec90a6da409bbd95f6e69e676b16f51127c637132a520533ccdcep_bytes: 558bec6aff6870fc4300682037440064timestamp: 2008-02-10 16:59:15
Version Info:
0: [No Data]

Trojan-PSW.Win32.Agent.ze also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.Y!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Downloader.Small.AAKR
ClamAV	Win.Worm.Socks-9
FireEye	Generic.mg.f23937fb899f1c5f
ALYac	Trojan.Downloader.Small.AAKR
Cylance	unsafe
Zillya	Trojan.Agent.Win32.2915205
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Password-Stealer ( 0000065f1 )
Alibaba	Backdoor:Win32/Koceg.3cc20700
K7GW	Password-Stealer ( 0000065f1 )
Cybereason	malicious.f81d24
Baidu	Win32.Trojan-PSW.Agent.e
Cyren	W32/Socks.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/PSW.LdPinch
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-PSW.Win32.Agent.ze
BitDefender	Trojan.Downloader.Small.AAKR
NANO-Antivirus	Trojan.Win32.Agent.cqsokb
Avast	Win32:LdPinch-AIH [Trj]
Tencent	Win32.Trojan-QQPass.QQRob.Rgil
Emsisoft	Trojan.Downloader.Small.AAKR (B)
F-Secure	Trojan.TR/BHO.Gen
DrWeb	Trojan.MulDrop.origin
VIPRE	Trojan.Downloader.Small.AAKR
TrendMicro	Mal_Socks1
McAfee-GW-Edition	BehavesLike.Win32.Generic.hm
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Ikarus	Virus.Win32.Agent.OLI
GData	Win32.Trojan.PSE.16ZCEX8
Jiangmin	Trojan/PSW.Agent.bvr
Webroot	W32.Trojan.Gen
Avira	TR/BHO.Gen
Antiy-AVL	Virus/Win32.Expiro.imp
Xcitium	TrojWare.Win32.PSW.Agent.~ZI@969gx
Arcabit	Trojan.Downloader.Small.AAKR
ZoneAlarm	Trojan-PSW.Win32.Agent.ze
Microsoft	Backdoor:Win32/Koceg.B
Google	Detected
AhnLab-V3	Trojan/Win.Agent.C5220338
Acronis	suspicious
McAfee	BackDoor-DRW
MAX	malware (ai score=89)
VBA32	BScope.Trojan.Downloader
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Ldpinch.AQH
TrendMicro-HouseCall	Mal_Socks1
Rising	Trojan.Agent!1.6618 (CLASSIC)
Yandex	Trojan.GenAsa!q9In3BxnDOQ
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1151844.susgen
Fortinet	W32/MANDA.TEO!worm
BitDefenderTheta	AI:Packer.D555F7661E
AVG	Win32:LdPinch-AIH [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)