Trojan-Spy.Win32.Agent.cbot malicious file

The Trojan-Spy.Win32.Agent.cbot is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan-Spy.Win32.Agent.cbot virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Trojan-Spy.Win32.Agent.cbot?


File Info:
name: A9EE8AD299F64FEA8010.mlw
path: /opt/CAPEv2/storage/binaries/8a08492b71fdaf9571cb720faf717e0cd7339f02fcf5aea48321035485a11522
crc32: 30C2AC5E
md5: a9ee8ad299f64fea80100220a3d72c80
sha1: 54aeec697f1f19c3a1c6d87cde72e031d126fd81
sha256: 8a08492b71fdaf9571cb720faf717e0cd7339f02fcf5aea48321035485a11522
sha512: dc80bae843f17d089139a6565833d1f62f43e4385592c1403da55e3ed1376891d442e74a05cfd465e60d52eec0ea042a84fb4c67e6b85369d75e0763e4c497e0
ssdeep: 1536:vFI5qdLnC0atiq+9Cc73McaTBFb0bJ+oa/xrpnHTlyojsjxNe22JjIHM:vF+qg0hq+Yc7Hf4oa5r5sojsj+oM
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D383F123DC86A253F2D753718F501AFAF69E8D163001970F6A49F4C212A62C9EC7E5ED
sha3_384: d7c61e4008db5d6c256a5c257d2e6b031e6e08eb56df3084c4ad59e87fe54b955744fc2af4ddd43b875fc4d1861cb00c
ep_bytes: e986620100e934620100e9de610100e9
timestamp: 2012-05-14 14:36:59

Version Info:
0: [No Data]

Trojan-Spy.Win32.Agent.cbot also known as:

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
MicroWorld-eScan	Backdoor.Farfli.AS
FireEye	Generic.mg.a9ee8ad299f64fea
ALYac	Backdoor.Farfli.AS
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 003c0f321 )
K7GW	Trojan ( 003c0f321 )
Cybereason	malicious.299f64
BitDefenderTheta	AI:Packer.C2C5287E1E
VirIT	Trojan.Win32.SHeur4.AFUN
Cyren	W32/Backdoor.AK.gen!Eldorado
Symantec	Trojan Horse
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Farfli.OC
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Spy.Win32.Agent.cbot
BitDefender	Backdoor.Farfli.AS
SUPERAntiSpyware	Trojan.Agent/Gen-Farfli
Avast	Win32:Farfli-AP [Trj]
Tencent	Backdoor.Win32.Gh0st.x
TACHYON	Trojan/W32.Agent.83456.ADJ
Emsisoft	Backdoor.Farfli.AS (B)
Baidu	Win32.Trojan.Farfli.m
F-Secure	Backdoor.BDS/Morix.bh.1
DrWeb	Trojan.PWS.Gamania.41998
VIPRE	Backdoor.Farfli.AS
TrendMicro	TSPY_AGENT_CF1027C6.RDXN
McAfee-GW-Edition	Generic BackDoor.abf
Trapmine	malicious.high.ml.score
Sophos	Troj/Agent-WIB
Ikarus	Backdoor.Win32.Morix
GData	Win32.Trojan.PSE.1QG5K2C
Jiangmin	TrojanSpy.Agent.vxi
Avira	BDS/Morix.bh.1
Antiy-AVL	Trojan[Spy]/Win32.Agent.cbot
Xcitium	TrojWare.Win32.Spy.Agent.CBOV@4pw0cc
Arcabit	Backdoor.Farfli.AS
ZoneAlarm	Trojan-Spy.Win32.Agent.cbot
Microsoft	Trojan:Win32/Vindor!pz
Google	Detected
AhnLab-V3	Trojan/Win32.Magania.R25443
McAfee	Generic BackDoor.abf
MAX	malware (ai score=88)
VBA32	TrojanPSW.Gamania
Malwarebytes	Malware.AI.133708466
Panda	Trj/Genetic.gen
Zoner	Trojan.Win32.27971
TrendMicro-HouseCall	TSPY_AGENT_CF1027C6.RDXN
Rising	Backdoor.Zegost!1.65A1 (CLASSIC)
Yandex	Trojan.GenAsa!ymk/PTHAyaM
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Wacatac.B!tr
AVG	Win32:Farfli-AP [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Trojan-Spy.Win32.Agent.cbot?

Trojan-Spy.Win32.Agent.cbot removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X