Trojan

Trojan.Win32.Agent.xalbqk removal guide

Malware Removal

The Trojan.Win32.Agent.xalbqk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan.Win32.Agent.xalbqk virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Deletes its original binary from disk
  • Creates a copy of itself
  • Harvests cookies for information gathering

How to determine Trojan.Win32.Agent.xalbqk?


File Info:

name: 21389197DF3E265D5C92.mlw
path: /opt/CAPEv2/storage/binaries/c9fcc7a0d995401daafba903bea56b7894a343960b432ed8ac5a29f9d4421ee0
crc32: A4C9EC04
md5: 21389197df3e265d5c920963b7282ac1
sha1: 8d4c839c7f3fdfb08a08ef3e10f7931abeb392b3
sha256: c9fcc7a0d995401daafba903bea56b7894a343960b432ed8ac5a29f9d4421ee0
sha512: 9967d77d61f37e5290c8393e2ce67f8314f17bf28ec01e46cbeee5119ff63688dcc6938a0b90c13531a8366b435f6968aaddb2b307227a9a2c1ca8fce284ab38
ssdeep: 384:bblK3Az3bscy0Nx5M932zmuh9IR04cZRnJI7vRy:bblSAjbsc9HK9Gdy64e67vI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C072D0C9EA587E99D2DA8D7CA362E801F57844BD1F98C70AEFD05C27858F0D0DA28616
sha3_384: 7fafa30b9033a8f3315542752680808a8de05069d6ddd80796ba197bbee3816089305ca72a276ea7eb7256d048fd947d
ep_bytes: 60be007041008dbe00a0feff57eb0b90
timestamp: 2021-11-20 08:13:48

Version Info:

0: [No Data]

Trojan.Win32.Agent.xalbqk also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Agent.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Razy.224219
FireEyeGeneric.mg.21389197df3e265d
ALYacGen:Variant.Razy.224219
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
K7GWTrojan-Downloader ( 005811d21 )
K7AntiVirusTrojan-Downloader ( 005811d21 )
BitDefenderThetaGen:NN.ZexaF.34084.amHfaapMNkm
CyrenW32/Dridex.EP.gen!Eldorado
ESET-NOD32a variant of Win32/TrojanDownloader.Agent.FTV
APEXMalicious
AvastWin32:Trojan-gen
ClamAVWin.Trojan.Generic-9907950-0
KasperskyTrojan.Win32.Agent.xalbqk
BitDefenderGen:Variant.Razy.224219
NANO-AntivirusTrojan.Win32.Razy.jilqcs
TencentMalware.Win32.Gencirc.10cf8c34
Ad-AwareGen:Variant.Razy.224219
EmsisoftGen:Variant.Razy.224219 (B)
VIPRETrojan.Win32.Agent.xfc (v)
TrendMicroTROJ_GEN.R002C0GKU21
McAfee-GW-EditionBehavesLike.Win32.Generic.lc
SophosMal/Generic-S
Paloaltogeneric.ml
JiangminTrojan.Agent.dsck
AviraTR/Downloader.Gen
Antiy-AVLTrojan/Generic.ASBOL.C4EC
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
GDataWin32.Trojan.PSE.1ETEWJE
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Generic.C4786956
Acronissuspicious
McAfeeGenericRXAA-AA!21389197DF3E
MAXmalware (ai score=81)
VBA32BScope.Backdoor.Androm
MalwarebytesMalware.AI.2963452190
TrendMicro-HouseCallTROJ_GEN.R002C0GKU21
YandexTrojan.DL.Agent!f+NnmkpDJU4
SentinelOneStatic AI – Malicious PE
FortinetW32/Agent.FTV!tr.dldr
AVGWin32:Trojan-gen
Cybereasonmalicious.7df3e2
PandaTrj/Genetic.gen
MaxSecureTrojan.Malware.300983.susgen

How to remove Trojan.Win32.Agent.xalbqk?

Trojan.Win32.Agent.xalbqk removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment