About “Trojan:Win32/Vagger!rfn” infection

The Trojan:Win32/Vagger!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Vagger!rfn virus can do?

Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Trojan:Win32/Vagger!rfn?


File Info:
crc32: A00F1059
md5: e4a9563c5652bd62ddbe13b5d6c3a786
name: ____________zc1.exe
sha1: f7c071d84f4cbc65ae0a761662e965fa23058109
sha256: c1fb48a1c2d4f27d5b87f2d409d6f91757051bbc7ac92b3f1f14156873b39898
sha512: 85ff6b32ea1e65c6849c4184249114d12674fc52409a1041a1f3e406080f967ed861b4656ed07ae1a82cb85aaa243cf1f5d890b981e7893e95759796f6119963
ssdeep: 6144:Bbww8NqVC5rVO7P2KSz15LznsDsotXGXbzf7NBe4HHBR8MnWS:aNB1YP2Ku15LzsDsotXGLzf7NBe4HHBf
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: x4f5cx8005x7248x6743x6240x6709 x8bf7x5c0ax91cdx5e76x4f7fx7528x6b63x7248
FileVersion: 1.0.0.0
Comments: x672cx7a0bx5e8fx4f7fx7528x6613x8bedx8a00x7f16x5199(http://www.eyuyan.com)
ProductName: x6613x8bedx8a00x7a0bx5e8f
ProductVersion: 1.0.0.0
FileDescription: x6613x8bedx8a00x7a0bx5e8f
Translation: 0x0804 0x04b0

Trojan:Win32/Vagger!rfn also known as:

FireEye	Generic.mg.e4a9563c5652bd62
Malwarebytes	Trojan.FlyStudio
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Genome.lRly
K7AntiVirus	Trojan ( 005194cc1 )
K7GW	Trojan ( 005194cc1 )
Cybereason	malicious.84f4cb
BitDefenderTheta	Gen:NN.ZexaF.34106.sq0@a4Z27Zgb
Cyren	W32/S-759a1e41!Eldorado
Symantec	ML.Attribute.HighConfidence
TotalDefense	Win32/FlyAgent!generic
Avast	Win32:Evo-gen [Susp]
GData	Win32.Worm.FlyStudio.C
Kaspersky	UDS:DangerousObject.Multi.Generic
NANO-Antivirus	Trojan.Win32.Inject.estkuj
Tencent	Win32.Trojan.Inject.Akov
Sophos	Generic PUA PH (PUA)
Comodo	TrojWare.Win32.FlyStudio.~UJ@1sa9s6
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.dm
SentinelOne	DFI – Suspicious PE
Trapmine	malicious.high.ml.score
APEX	Malicious
F-Prot	W32/S-759a1e41!Eldorado
Jiangmin	Trojan.Inject.aaii
Antiy-AVL	GrayWare/Win32.FlyStudio.b
Endgame	malicious (high confidence)
SUPERAntiSpyware	Trojan.Agent/Gen-OnlineGames
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Vagger!rfn
TACHYON	Trojan/W32.Inject.305664.L
AhnLab-V3	Trojan/Win32.Inject.C2431897
Acronis	suspicious
McAfee	Artemis!E4A9563C5652
VBA32	Trojan.Inject
Cylance	Unsafe
Panda	Trj/CI.A
ESET-NOD32	a variant of Win32/Packed.FlyStudio potentially unwanted
Rising	Trojan.Inject!8.103 (CLOUD)
Yandex	Trojan.Agent2!ZAXAhwBfoOI
Ikarus	Worm.Win32.Nuj
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/FlyStudio.C!tr
Webroot
AVG	FileRepMalware
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Trojan.97a

How to remove Trojan:Win32/Vagger!rfn?

Trojan:Win32/Vagger!rfn removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X