Ransom Trojan

Trojan.Ransom.Agent.DT removal tips

Malware Removal

The Trojan.Ransom.Agent.DT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Ransom.Agent.DT virus can do?

  • Sample contains Overlay data
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • Exhibits possible ransomware file modification behavior
  • Anomalous binary characteristics

How to determine Trojan.Ransom.Agent.DT?


File Info:

name: 88FA16F4180D2B1D7502.mlw
path: /opt/CAPEv2/storage/binaries/669ac1248d98b93d0b26983f5fab03d306a58e4e11d44ee82a3719affc02e246
crc32: DA787B6F
md5: 88fa16f4180d2b1d7502935160fc1cbd
sha1: 2e8a74353bdb86a5e376c17aaedd40c3f9dc7f3e
sha256: 669ac1248d98b93d0b26983f5fab03d306a58e4e11d44ee82a3719affc02e246
sha512: 3fbbc8a24dc1bee4c5463c49ea0fd81bbf5dc0378dc15aecd06d024549090677963d64ec9f3f8aa4b16860bf8b6af2d7918042f31dcb2a8653ba1fce99e972b5
ssdeep: 3072:tuTO4rRZiCDvXHmGCgXscjpU39Eq+ZDPUEMTlqWaNjD0jTV5Bidebtlo+:tkZpDv3mGC0ns9IZDPFMTFgojT8e5lh
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T11A04A04BB3F400A9D076D2B6C8B647069BB1BC110B7193CF266987AA5F337E49D35326
sha3_384: be413d6fb15502c7495f377919efa63c7de9a6bcccd41e8c8413a1a5e533d149ec3abb1cfdd2fcd4a2f5baaf586b8752
ep_bytes: e848feffffc82000004c897c24f84883
timestamp: 2019-11-05 20:50:30

Version Info:

CompanyName: Microsoft Corporation
FileDescription: Windows® installer
FileVersion: 5.0.7601.24535 (win7sp1_ldr_escrow.191105-1059)
InternalName: msiexec
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: msiexec.exe
ProductName: Windows Installer - Unicode
ProductVersion: 5.0.7601.24535
Translation: 0x0409 0x04b0

Trojan.Ransom.Agent.DT also known as:

DrWebTrojan.Encoder.36209
MicroWorld-eScanTrojan.Ransom.Agent.DT
CylanceUnsafe
CyrenW64/Ipamor.A
ESET-NOD32Win64/Filecoder.GG
BitDefenderTrojan.Ransom.Agent.DT
AvastWin64:Trojan-gen
Ad-AwareTrojan.Ransom.Agent.DT
EmsisoftTrojan.Ransom.Agent.DT (B)
FireEyeTrojan.Ransom.Agent.DT
GDataTrojan.Ransom.Agent.DT
JiangminTrojan.Blocker.urx
GoogleDetected
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 100)
MAXmalware (ai score=82)
MalwarebytesRansom.Azov
MaxSecureTrojan.Malware.121218.susgen
FortinetW64/Filecoder.GG!tr
AVGWin64:Trojan-gen
CrowdStrikewin/malicious_confidence_60% (D)

How to remove Trojan.Ransom.Agent.DT?

Trojan.Ransom.Agent.DT removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment