Trojan.Win32.Agent.xalbqk removal guide

The Trojan.Win32.Agent.xalbqk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Agent.xalbqk virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Deletes its original binary from disk
• Creates a copy of itself
• Harvests cookies for information gathering

How to determine Trojan.Win32.Agent.xalbqk?

File Info:
name: 21389197DF3E265D5C92.mlw
path: /opt/CAPEv2/storage/binaries/c9fcc7a0d995401daafba903bea56b7894a343960b432ed8ac5a29f9d4421ee0
crc32: A4C9EC04
md5: 21389197df3e265d5c920963b7282ac1
sha1: 8d4c839c7f3fdfb08a08ef3e10f7931abeb392b3
sha256: c9fcc7a0d995401daafba903bea56b7894a343960b432ed8ac5a29f9d4421ee0
sha512: 9967d77d61f37e5290c8393e2ce67f8314f17bf28ec01e46cbeee5119ff63688dcc6938a0b90c13531a8366b435f6968aaddb2b307227a9a2c1ca8fce284ab38
ssdeep: 384:bblK3Az3bscy0Nx5M932zmuh9IR04cZRnJI7vRy:bblSAjbsc9HK9Gdy64e67vI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C072D0C9EA587E99D2DA8D7CA362E801F57844BD1F98C70AEFD05C27858F0D0DA28616
sha3_384: 7fafa30b9033a8f3315542752680808a8de05069d6ddd80796ba197bbee3816089305ca72a276ea7eb7256d048fd947d
ep_bytes: 60be007041008dbe00a0feff57eb0b90
timestamp: 2021-11-20 08:13:48

Version Info:
0: [No Data]

Trojan.Win32.Agent.xalbqk also known as:

How to remove Trojan.Win32.Agent.xalbqk?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.