Trojan.Win32.Agent.xafguf (file analysis)

The Trojan.Win32.Agent.xafguf is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Agent.xafguf virus can do?

Executable code extraction
Creates RWX memory
Unconventionial language used in binary resources: Ukrainian
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Detects Sandboxie through the presence of a library
Detects Avast Antivirus through the presence of a library
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan.Win32.Agent.xafguf?


File Info:
crc32: 6DFC4F2A
md5: e75be95abaf67f381b83874453784b87
name: E75BE95ABAF67F381B83874453784B87.mlw
sha1: f191263fbe22d397f4522e2a3a26a5e5e838e5ac
sha256: f0e943a3190bd714808505bef47752c11cf58ae444bfed34d44675ef4a043d8d
sha512: 736fd3b3c05051fc0c4894e40323b04716a88a44730d6be8e3bacc86b20591f010324adc4627e040ba6220a1728829b08297b9c6b136f0d6efe2d17a7bf91040
ssdeep: 1536:Ikr9hF1s1I6AsesyvuaD8mW14RjGdu1VGT9heL5IAnrA5cPmdZf13OK2lhPFxBI:V1sNymi7W14Uu1+9QFIAnrh23OT
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
InternalSurname: debaukd.ekze
Prod: 1.2.7
FileVersions: 1.0.5.6
LegalCo: Copyri (C) 2019, permudationz

Trojan.Win32.Agent.xafguf also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.45225223
FireEye	Generic.mg.e75be95abaf67f38
McAfee	RDN/GenericM
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 005756061 )
BitDefender	Trojan.GenericKD.45225223
K7GW	Trojan ( 005756061 )
BitDefenderTheta	Gen:NN.ZexaF.34700.jmGfaGmDywdc
Cyren	W32/Kryptik.CVF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:DropperX-gen [Drp]
Kaspersky	Trojan.Win32.Agent.xafguf
Alibaba	Trojan:Win32/Zenpack.867ccb5a
ViRobot	Trojan.Win32.Z.Agent.157696.VU
Rising	Backdoor.Agent!8.C5D (TFE:5:IhzqwXEXQUL)
Ad-Aware	Trojan.GenericKD.45225223
Emsisoft	Trojan.GenericKD.45225223 (B)
Comodo	Malware@#3ffw58lwj0vcc
F-Secure	Trojan.TR/Kryptik.imunq
DrWeb	Trojan.PWS.Siggen2.58526
McAfee-GW-Edition	BehavesLike.Win32.Trojan.cc
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Jiangmin	Exploit.ShellCode.beh
Avira	TR/Kryptik.imunq
Antiy-AVL	Trojan/Win32.Kryptik
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Trojan:Win32/Zenpack.MT!MTB
Gridinsoft	Trojan.Win32.Packed.oa
Arcabit	Trojan.Generic.D2B21507
ZoneAlarm	Trojan.Win32.Agent.xafguf
GData	Trojan.GenericKD.45225223
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Glupteba.R361154
Acronis	suspicious
VBA32	Trojan.Agent
ALYac	Trojan.GenericKD.45225223
MAX	malware (ai score=88)
Malwarebytes	Trojan.MalPack.GS
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HILR
Tencent	Win32.Trojan.Agent.Ajvf
Ikarus	Trojan.Win32.Krypt
eGambit	Unsafe.AI_Score_90%
Fortinet	W32/Kryptik.HGHW!tr
AVG	Win32:DropperX-gen [Drp]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Generic/HEUR/QVM11.1.3C27.Malware.Gen

How to remove Trojan.Win32.Agent.xafguf?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan.Win32.Agent.xafguf (file analysis)