Should I remove “Trojan.Win32.Agentb.kpqk”?

The Trojan.Win32.Agentb.kpqk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Agentb.kpqk virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Behavioural detection: Transacted Hollowing
• Exhibits possible ransomware file modification behavior
• Detects Bochs through the presence of a registry key
• Checks the version of Bios, possibly for anti-virtualization
• Attempted to write directly to a physical drive
• Collects information to fingerprint the system
• Anomalous binary characteristics

Related domains:

How to determine Trojan.Win32.Agentb.kpqk?

File Info:
name: 825B20525015E1B678D1.mlw
path: /opt/CAPEv2/storage/binaries/05acc582eef77442ef47e146ffc836fd59b939fb8dd19ad7d65119f6e34be6aa
crc32: EB590F58
md5: 825b20525015e1b678d1a1fc41542f56
sha1: 41d7571bb02703f7e13d9615d8f8063d35c8b6b6
sha256: 05acc582eef77442ef47e146ffc836fd59b939fb8dd19ad7d65119f6e34be6aa
sha512: dae7edbe7ed29aae17a2a847f926f9fee4be826c8002c8ba368661c060da2c1a6a9171458f933482823cc021fb306062dac34f2ded9de988c3c39178ce2b7f3c
ssdeep: 196608:g+gqLKB2pNcz9qcqDg8vUru7r1HabrAeF6usIz6Do:g+jOB2p2zUhDgrru7r1HawJsP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19B76F131378AC53BD5A205B06A3CDAAF5119BFB50F7694C7A3E41E2E45B48C21732E27
sha3_384: 62a50547efce092a5b7c1ee86c06d6ddb1b4da2286b5685718b8bcf329cf66746e389a089df54dc0c1e112bcd5380d00
ep_bytes: e86c060000e97afeffffcccccccccc51
timestamp: 2021-07-27 13:39:02

Version Info:
CompanyName: PlagiusLib
FileDescription: Disk Studio Installer
FileVersion: 3.0.1.3
InternalName: OpenStudio
LegalCopyright: Copyright (C) 2021 PlagiusLib
OriginalFileName: OpenStudio.exe
ProductName: Disk Studio
ProductVersion: 3.0.1.3
Translation: 0x0409 0x04b0

Trojan.Win32.Agentb.kpqk also known as:

How to remove Trojan.Win32.Agentb.kpqk?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.