Trojan:Win32/Agent.OE (file analysis)

The Trojan:Win32/Agent.OE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Agent.OE virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Code injection with CreateRemoteThread in a remote process
• Attempts to modify desktop wallpaper
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• A process attempted to delay the analysis task by a long amount of time.
• Installs itself for autorun at Windows startup
• Operates on local firewall’s policies and settings
• Attempts to disable Windows Auto Updates
• Attempts to modify or disable Security Center warnings
• Modifies Image File Execution Options, indicative of process injection or persistence
• Anomalous binary characteristics

How to determine Trojan:Win32/Agent.OE?

File Info:
name: A00DD85AD15916133B69.mlw
path: /opt/CAPEv2/storage/binaries/5881ec6100b77f01d29f4bad7b3b5422c516aaaea9a8724dfe22b88ebb7d82c5
crc32: 958F22CA
md5: a00dd85ad15916133b697797d02cb185
sha1: c97764b5883fac4d1a1d740e925eeb70fff8324e
sha256: 5881ec6100b77f01d29f4bad7b3b5422c516aaaea9a8724dfe22b88ebb7d82c5
sha512: 7b33167ffbba30cbe56f53779728616c901743c5d927e85ae9b86a74e2f83b47ef9dcf7246b90db4b14b2d98e89f471543d4bc8c1e9b7144bfcb149b6d7f1f4b
ssdeep: 768:sIU61JpZkZgaVu0P5eH9KwEt0x+ORH2fXD9OWOEH/kxPYR:sw9aV1eH9Klt0IOYfQWOKcxk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T115E2E0DFB1B56F6DD7A20A748417CB60607DC13433A838A623C8D786680497F7EAC769
sha3_384: 92047406b23c755120085ace144a5726c006f97476468d5a5366c2410d916e00b898a9ae421266418f62a082eeaf9b1b
ep_bytes: 55ba0010400057565381ec740500008d
timestamp: 2006-12-14 12:59:25

Version Info:
0: [No Data]

Trojan:Win32/Agent.OE also known as:

How to remove Trojan:Win32/Agent.OE?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.