Categories: Trojan

Trojan.Win32.Agent.xalmzt removal guide

The Trojan.Win32.Agent.xalmzt is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Agent.xalmzt virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
A process created a hidden window
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Uses suspicious command line tools or Windows utilities

How to determine Trojan.Win32.Agent.xalmzt?


File Info:
name: 869B040755C119E16782.mlwpath: /opt/CAPEv2/storage/binaries/68db789fd6022a4f031e67eceba6916a1484ed31a254c13ee71c5088a1dae1fecrc32: F4A762FFmd5: 869b040755c119e167828f573bef351esha1: a7d6ca7c57ebcc81fc761253a586b092538abe3asha256: 68db789fd6022a4f031e67eceba6916a1484ed31a254c13ee71c5088a1dae1fesha512: 1552c02de935a8c6a00bd10fdd66169ca9d18f9e1c497513810b66cd712c9e1948bfdfc7e2e3b317b437b3ff46089db697b6234e52b43cb81d801fbe6e409f06ssdeep: 384:btyhCe1OZaU8m933mPoeKIp1Q+7+0Avkv8Or5Q+LFQSCzQ39Q3V7/LpSjCuO+9yT:bQCfD8oHZeHvLJuMIHpTuOyJUljtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1CAE22B239E50D4F2F11596F653B20738BEB8C7862871467BDFA0CD71ACB2A21974B84Dsha3_384: b8a178eef1786336896b79cff6621d1960db9e7c68660e1ae37be74a672c368c8b2eaaf91e674d0fb61ca4748220df86ep_bytes: e85b3e0000e8753d000033c0c3909090timestamp: 2021-09-13 03:49:37
Version Info:
FileVersion: 1.0.0.0FileDescription: 易语言程序ProductName: 易语言程序ProductVersion: 1.0.0.0LegalCopyright: 作者版权所有 请尊重并使用正版Comments: 本程序使用易语言编写(http://www.dywt.com.cn)Translation: 0x0804 0x04b0

Trojan.Win32.Agent.xalmzt also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Dinwod.mgDt
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen16.3819
MicroWorld-eScan	Gen:Trojan.Heur.FU.cq0@aW0Ty9hb
FireEye	Generic.mg.869b040755c119e1
CAT-QuickHeal	Ransom.Genasom.16527
ALYac	Gen:Trojan.Heur.FU.cq0@aW0Ty9hb
Cylance	Unsafe
K7AntiVirus	Adware ( 005835081 )
Alibaba	Trojan:Win32/Generic.5a90185f
K7GW	Adware ( 005835081 )
Cybereason	malicious.755c11
BitDefenderTheta	AI:Packer.B8CBCFC71F
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.BlackMoon.A potentially unwanted
TrendMicro-HouseCall	TROJ_GEN.R002C0PLR21
ClamAV	Win.Malware.Aw0ty9hb-9916836-0
Kaspersky	Trojan.Win32.Agent.xalmzt
BitDefender	Gen:Trojan.Heur.FU.cq0@aW0Ty9hb
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.10cfa45e
Ad-Aware	Gen:Trojan.Heur.FU.cq0@aW0Ty9hb
Sophos	Mal/Generic-S
Zillya	Trojan.Agent.Win32.2601631
TrendMicro	TROJ_GEN.R002C0PLR21
McAfee-GW-Edition	GenericRXGM-IF!869B040755C1
Emsisoft	Gen:Trojan.Heur.FU.cq0@aW0Ty9hb (B)
Ikarus	Trojan.Win32.HackTool
GData	Win32.Trojan.PSE.1ETEWJE
Jiangmin	Trojan.Agent.dtfv
eGambit	Unsafe.AI_Score_93%
Avira	TR/Agent.ktoiu
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Generic.ASMalwS.34EDC0C
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.IF.R458937
McAfee	GenericRXGM-IF!869B040755C1
VBA32	BScope.Trojan.Scar
Malwarebytes	PUP.Optional.ChinAd
APEX	Malicious
Rising	Trojan.Kryptik!1.B3E8 (CLASSIC)
Yandex	Trojan.Agent!YAfK6+gvSnU
SentinelOne	Static AI – Malicious PE
Fortinet	Riskware/HackTool
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A