Categories: Trojan

Trojan:Win32/SoreFang removal guide

The Trojan:Win32/SoreFang is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/SoreFang virus can do?

Uses Windows utilities for basic functionality
Authenticode signature is invalid
Detects Bochs through the presence of a registry key
Checks the version of Bios, possibly for anti-virtualization
Checks the CPU name from registry, possibly for anti-virtualization
Creates a copy of itself
Collects information to fingerprint the system

How to determine Trojan:Win32/SoreFang?


File Info:
name: A32E1202257A2945BF0F.mlwpath: /opt/CAPEv2/storage/binaries/a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064crc32: D0E24E9Amd5: a32e1202257a2945bf0f878c58490af8sha1: 416df2d22338f412571cdaedb40ab33eb38977afsha256: a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064sha512: 92ac91e36fc9a8463b2a7b00e6dba687e86a15484d836cb2c8d399d76cd012b71523a9ddae43d9795e2c14fdb7ccc2137d668f7c691b47a2e266a4bfe48de71assdeep: 6144:4t4156qfXqT02bFXCYv123kUo4GECAOcL6xDE4U:oc6qkt5vdU6ECe4Utype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T13F94B2A16D89903DF45A20382B3DAA7705A87F210794FF8BD388577E5E20BB157B3712sha3_384: fad5fdbe2e2051b80da378807fa7687f5128cf0d11a927ed0df2acbfd43634f324ee7f62fe7c4f9e19d02bb795bec564ep_bytes: e860050000e98efeffffff25e8c14300timestamp: 2018-03-12 14:02:59
Version Info:
CompanyName: Sangfor Technologies Co.,LtdFileDescription: SangforUDFileVersion: 7.6.0.100InternalName: SangforUD.exeLegalCopyright: Copyright (C) 2015OriginalFilename: SangforUD.EXEProductName: SangforUD applicationProductVersion: 7.6.0.100Translation: 0x0409 0x04b0

Trojan:Win32/SoreFang also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agentb.X!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.SoreFang.A5
Skyhigh	BehavesLike.Win32.NetLoader.gh
McAfee	PWS-FCPM!A32E1202257A
Malwarebytes	Trojan.Sangfor
Zillya	Trojan.Agent.Win32.1311202
Sangfor	Trojan.Win32.Wellmess.IOC
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanSpy:Win32/SoreFang.beeb879d
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	AI:Packer.8AEE68F41F
VirIT	Trojan.Win32.SpyAgent.CUMM
Symantec	Downloader.Sorefang
ESET-NOD32	Win32/Spy.Agent.PXZ
APEX	Malicious
Kaspersky	Trojan.Win32.Agentb.jxgl
BitDefender	Gen:Variant.Zusy.376156
NANO-Antivirus	Trojan.Win32.PWS.hulzle
MicroWorld-eScan	Gen:Variant.Zusy.376156
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.115dfd20
Sophos	Troj/SoreFang-A
F-Secure	Heuristic.HEUR/AGEN.1351616
DrWeb	BackDoor.Siggen2.3412
VIPRE	Gen:Variant.Zusy.376156
TrendMicro	TrojanSpy.Win32.DARKHOTEL.YAAG-A
Emsisoft	Gen:Variant.Zusy.376156 (B)
GData	Gen:Variant.Zusy.376156
Jiangmin	Trojan.Agentb.gnc
Webroot	W32.Malware.Gen
Varist	W32/Wellmess.XXSF-8736
Avira	HEUR/AGEN.1351616
Antiy-AVL	Trojan[APT]/Win32.WellMess
Kingsoft	malware.kb.a.937
Xcitium	Malware@#sku81bcq6omq
Arcabit	Trojan.Zusy.D5BD5C
ViRobot	Trojan.Win32.S.Agent.434688.BN
ZoneAlarm	Trojan.Win32.Agentb.jxgl
Microsoft	Trojan:Win32/SoreFang
Google	Detected
AhnLab-V3	Trojan/Win.Darkhotel.R536056
VBA32	Trojan.Agentb
Cylance	unsafe
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TrojanSpy.Win32.DARKHOTEL.YAAG-A
Rising	Trojan.FakeSanforUD!1.C480 (CLASSIC)
Ikarus	Trojan-Spy.Agent
MaxSecure	Trojan.Malware.83557616.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS