What is “Trojan.Win32.Agent.xahrao”?

The Trojan.Win32.Agent.xahrao is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Win32.Agent.xahrao virus can do?

CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Trojan.Win32.Agent.xahrao?


File Info:
name: 1675AEDFFBC970B5FA2B.mlw
path: /opt/CAPEv2/storage/binaries/5ce80fdc583f1094dfa8da08479a1e28eec56635d7626156d66badeef4713c78
crc32: 2A623FCF
md5: 1675aedffbc970b5fa2b52828925c743
sha1: b92f1e39ce7739530d31b53d8301b6f2b0de2d9f
sha256: 5ce80fdc583f1094dfa8da08479a1e28eec56635d7626156d66badeef4713c78
sha512: b48538dc45365b9c8f08238b1042438b73b2d82b1d6da2f911745076efb216d00f97602fffa9c7684258e543010939b130c36d767a06b6b7109abb83ea252853
ssdeep: 98304:9U/feSBoNbetZhV0bTdYUawuijG+lSYdvahC72uP:iuSwetZBUc1KSYNahC5P
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10BE533880379C626C65F5B714A297319B43CEE1B9901512F528CB06FBE39F8B858CE37
sha3_384: cfa948b0198f3aacd39b5e5563da16692515ba72c8db592a758c66ed219b9b76843d2d382cecebca737d545d578f5378
ep_bytes: ff250020400000000000000000000000
timestamp: 2018-03-26 09:14:53

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: Youtube Downloader
FileVersion: 0.0.0.1
InternalName: DemoWpf.exe
LegalCopyright: Copyright ©  2018
LegalTrademarks: 
OriginalFilename: DemoWpf.exe
ProductName: Youtube Downloader
ProductVersion: 0.0.0.1
Assembly Version: 0.0.0.1

Trojan.Win32.Agent.xahrao also known as:

Bkav	W32.Common.0F63DD18
Lionic	Trojan.Win32.Agent.Y!c
Skyhigh	Artemis
McAfee	Artemis!1675AEDFFBC9
Cylance	unsafe
Zillya	Trojan.Agent.Win32.1112409
Alibaba	Trojan:Win32/Generic.d7b7ec37
Symantec	ML.Attribute.HighConfidence
Kaspersky	Trojan.Win32.Agent.xahrao
Tencent	Malware.Win32.Gencirc.13badc33
DrWeb	Trojan.DownLoader28.2094
Jiangmin	Trojan.Agent.eqfk
Webroot	W32.Trojan.Gen
Antiy-AVL	Trojan/Win32.Agent
ZoneAlarm	Trojan.Win32.Agent.xahrao
VBA32	TScope.Trojan.MSIL
Rising	Trojan.Agent!8.B1E (CLOUD)
MaxSecure	Trojan.Malware.118079958.susgen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_60% (W)

How to remove Trojan.Win32.Agent.xahrao?

Trojan.Win32.Agent.xahrao removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X