Trojan

Trojan:Win32/Convagent!ic removal

Malware Removal

The Trojan:Win32/Convagent!ic is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:Win32/Convagent!ic virus can do?

  • Sample contains Overlay data
  • Presents an Authenticode digital signature
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Convagent!ic?



File Info:

name: 3321396AFD71FD3BD1EE.mlw
path: /opt/CAPEv2/storage/binaries/e507b0b33685c97898f9c10840677be5ed3375cd731096c391a4db8a3aeb28b8
crc32: C7A1AC0B
md5: 3321396afd71fd3bd1ee92d3367c43fc
sha1: 4d44ddc22c7da827ad05ad0c221daf26a55080de
sha256: e507b0b33685c97898f9c10840677be5ed3375cd731096c391a4db8a3aeb28b8
sha512: 0c7b5027bb1c2a5488835b4ce4516106e824828681960d7d273180e13dcfa680b5fe8caeb6f856d2a62e5c4cefe5f8ac375ea5ac47e8b7c728ac241d25b5a131
ssdeep: 3072:VPaO2i8oJNMgxr9vvddxKu1coG+WTzkyt96+ZYLVE:VSVijJNM4VvdDKu1cwG79TYx
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T14C149E107248C13AF4A7257188F9DA79AAB9B831175F21DBFBC40A6D4F227E17A30347
sha3_384: 548ef392a9e1f19c532ec5d337d03989c2164cce9ad36898a988d1eed658c07d89658b2049dcc4f686d29e3085560bd0
ep_bytes: e8ab770000e9a4feffff3b0d30d54200
timestamp: 2023-05-28 01:01:51


Version Info:

Comments: 89xsFFtL50ny6xUspFdoyy6dFsphWF
CompanyName: The Home Depot, Inc.
FileDescription: The Home Depot, Inc. Product
FileVersion: 8,899,96,489
InternalName: PFI9RMldpu
LegalCopyright: Copyright © The Home Depot, Inc. All rights reserved.
LegalTrademarks: Trademark © The Home Depot, Inc.
OriginalFilename: aA86qISn
ProductName: 9hlzzkvdzc8g
ProductVersion: 8,899,96,489
Translation: 0x081a 0x081a

Trojan:Win32/Convagent!ic also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Convagent.4!c
MicroWorld-eScanTrojan.GenericKD.67268343
FireEyeGeneric.mg.3321396afd71fd3b
ALYacTrojan.GenericKD.67268343
Cylanceunsafe
VIPRETrojan.GenericKD.67268343
SangforTrojan.Win32.Agent.Vw3p
K7AntiVirusTrojan ( 0059ec631 )
BitDefenderTrojan.GenericKD.67268343
K7GWTrojan ( 0059ec631 )
ArcabitTrojan.Generic.D4026EF7
CyrenW32/Kryptik.JXN.gen!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Kryptik.HSPP
APEXMalicious
KasperskyHEUR:Trojan.MSIL.Convagent.gen
AlibabaTrojan:MSIL/Convagent.918f2c71
AvastWin32:CrypterX-gen [Trj]
RisingStealer.Agent!8.C2 (TFE:5:r2ALkBiM5NG)
EmsisoftTrojan.GenericKD.67268343 (B)
F-SecureTrojan.TR/AD.Nekark.tafbr
DrWebTrojan.PWS.Stealer.36575
ZillyaTrojan.Convagent.Win32.24705
TrendMicroTROJ_GEN.R011C0DEU23
McAfee-GW-EditionGenericRXWB-VH!3321396AFD71
Trapminemalicious.high.ml.score
SophosTroj/Krypt-YT
IkarusTrojan-Spy.Agent
GoogleDetected
AviraTR/AD.Nekark.tafbr
MAXmalware (ai score=89)
Antiy-AVLTrojan/Win32.Kryptik
MicrosoftTrojan:Win32/Convagent!ic
ZoneAlarmHEUR:Trojan.MSIL.Convagent.gen
GDataWin32.Trojan.PSE.10CRB02
CynetMalicious (score: 99)
AhnLab-V3Trojan/Win.Trojan-gen.R582519
McAfeeGenericRXWB-FM!3321396AFD71
TACHYONTrojan/W32.Agent.197887.B
VBA32BScope.TrojanPSW.RedLine
MalwarebytesGeneric.Crypt.Trojan.DDS
PandaTrj/Genetic.gen
TrendMicro-HouseCallTROJ_GEN.R011C0DEU23
TencentMalware.Win32.Gencirc.10bee517
YandexTrojan.Kryptik!DKPRQcZs8SI
MaxSecureTrojan.Malware.109640529.susgen
FortinetW32/Kryptik.HTQS!tr
AVGWin32:CrypterX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan:Win32/Convagent!ic?

Trojan:Win32/Convagent!ic removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment