Trojan.Win32.Agent.spto (file analysis)

The Trojan.Win32.Agent.spto is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Agent.spto virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Behavioural detection: Injection (inter-process)
• Attempts to disable Windows Auto Updates
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan.Win32.Agent.spto?

File Info:
name: F6205F4C82E951896781.mlw
path: /opt/CAPEv2/storage/binaries/478887525066a523404be2b333fa9393bea376cccdc2fa93240fa1e654cde755
crc32: 5B25A135
md5: f6205f4c82e951896781c1d72a81ce51
sha1: ddb7301a6e68e3ee1073d51fa5c445767e4db374
sha256: 478887525066a523404be2b333fa9393bea376cccdc2fa93240fa1e654cde755
sha512: 00b3931920ad793ce5a186b45b57c84c41d8c0d166abb841ca197730c3ad3518ad9e8bbc704b099dd03334b94e034ceb282d81fc4aa1865c6bbedf03698f0b6e
ssdeep: 1536:fxeSb9U3Ax8Q89H1UbLSL6AOocTzFJ0T72Vp:vS3Ax4GBTzFJ0T72
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B4A33DD571C0D86DC27CDD7C23CE86B23CD1AB0BB60B5E4F6364AF659C26A185720A72
sha3_384: 0c00c478339cc74e932c33a5c68494ae9a52fff854a91f4ddaaabbd5ff86313e9b91fe48fd74be01c01debd995bbe162
ep_bytes: 6804124000e8eeffffff000000000000
timestamp: 2012-06-27 08:16:17

Version Info:
0: [No Data]

Trojan.Win32.Agent.spto also known as:

How to remove Trojan.Win32.Agent.spto?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.