Spy Trojan

About “Trojan.Spy.Agent.OLU” infection

Malware Removal

The Trojan.Spy.Agent.OLU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan.Spy.Agent.OLU virus can do?

  • Attempts to connect to a dead IP:Port (2 unique times)
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Unconventionial binary language: Russian
  • Unconventionial language used in binary resources: Russian
  • Looks up the external IP address
  • Uses Windows utilities for basic functionality
  • Attempts to remove evidence of file being downloaded from the Internet
  • Attempts to delete volume shadow copies
  • Deletes its original binary from disk
  • Exhibits behavior characteristic of Alphacrypt/Teslacrypt ransomware
  • Modifies boot configuration settings
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Writes a potential ransom message to disk
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Creates a known TeslaCrypt/AlphaCrypt ransomware decryption instruction / key file.
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz
myexternalip.com
ocsp.pki.goog
gjesdalbrass.no
garrityasphalt.com
www.garrityasphalt.com
grassitup.com
grupograndes.com
graysonacademy.com
crl.pki.goog
crls.pki.goog
crown.essaudio.pl

How to determine Trojan.Spy.Agent.OLU?


File Info:

crc32: 9F4193B2
md5: 056fa68a3a2b65e4677f685746283209
name: 056FA68A3A2B65E4677F685746283209.mlw
sha1: 991f7fa89b13f94a5de106950c14a2f0321069f6
sha256: c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71
sha512: cca455cacc8bedb3766762327b3b7e640386d16470a538335f119dda3369a7e1963561ea7a9fd112327a0a5ccbeb464ac2f7ab274fbc968dec159a6270ac2061
ssdeep: 3072:iJJJArB2+7jFIka35Bo4g+8doX5PxFmkKXg562r7GnPRJQ1xAxCJPE:inJQT7jGkSHp0oXxLmkKXg56hQjAxCE
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2015
InternalName: TODO:
FileVersion: 1.0.0.1
CompanyName: TODO:
ProductName: TODO:
ProductVersion: 1.0.0.1
FileDescription: TODO:
OriginalFilename: TODO:
Translation: 0x0419 0x04b0

Trojan.Spy.Agent.OLU also known as:

Elasticmalicious (high confidence)
DrWebTrojan.Encoder.1694
MicroWorld-eScanTrojan.Spy.Agent.OLU
ALYacTrojan.Spy.Agent.OLU
CylanceUnsafe
ZillyaTrojan.Generic.Win32.696313
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_70% (W)
AlibabaRansom:Win32/Tescrypt.9d82db57
K7GWTrojan ( 004dbeae1 )
K7AntiVirusTrojan ( 004dbeae1 )
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Filecoder.TeslaCrypt.I
APEXMalicious
AvastWin32:CryptoWall-AI [Trj]
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderTrojan.Spy.Agent.OLU
NANO-AntivirusVirus.Win32.Gen.ccmw
ViRobotTrojan.Win32.Z.Teslacrypt.258048
TencentMalware.Win32.Gencirc.116a22ed
Ad-AwareTrojan.Spy.Agent.OLU
SophosMal/Generic-R + Troj/Tescrypt-C
BitDefenderThetaGen:NN.ZexaF.34170.pu1@aqoDZmdk
VIPRETrojan.Win32.Generic!BT
TrendMicroRansom_Tescrypt.R002C0DGR21
McAfee-GW-EditionRDN/Ransom
FireEyeGeneric.mg.056fa68a3a2b65e4
EmsisoftTrojan.Spy.Agent.OLU (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Generic.ejolr
AviraHEUR/AGEN.1113288
eGambitUnsafe.AI_Score_98%
Antiy-AVLTrojan/Generic.ASMalwS.2ADEF1D
MicrosoftRansom:Win32/Tescrypt.C
GDataTrojan.Spy.Agent.OLU
TACHYONTrojan/W32.Agent.258048.AUB
AhnLab-V3Trojan/Win32.Teslacrypt.R182517
McAfeeRDN/Ransom
MAXmalware (ai score=81)
VBA32Hoax.Bitman
MalwarebytesMalware.AI.4190406669
TrendMicro-HouseCallRansom_Tescrypt.R002C0DGR21
RisingTrojan.Generic@ML.90 (RDML:U8gR2RgU0pZx8JDxWvVCpg)
YandexTrojan.GenAsa!79pel6v3wxI
IkarusTrojan-Ransom.TeslaCrypt
MaxSecureTrojan.Malware.7164915.susgen
FortinetW32/TeslaCrypt.I!tr
AVGWin32:CryptoWall-AI [Trj]
Paloaltogeneric.ml

How to remove Trojan.Spy.Agent.OLU?

Trojan.Spy.Agent.OLU removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment