Malware

Should I remove “UDS:Downloader.Win32.Agent”?

Malware Removal

The UDS:Downloader.Win32.Agent is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What UDS:Downloader.Win32.Agent virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (4 unique times)
  • Presents an Authenticode digital signature
  • Reads data out of its own binary image
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Collects information about installed applications
  • Collects information to fingerprint the system

Related domains:

downloader.aldtop.com
client.aldtop.com
channel.gameloop.fun
resource.aldtop.com

How to determine UDS:Downloader.Win32.Agent?


File Info:

crc32: 62129B9C
md5: cadb7f161d87fedd8aab2e92d862e3ca
name: CADB7F161D87FEDD8AAB2E92D862E3CA.mlw
sha1: ff36d5d8f90e655d70cd5d6e2a0e9f4a3d483489
sha256: 990d42b31c7c7ca97b70eca2e771c3847cb16ff102f3943e519f1b5fafcda46a
sha512: 02628cb4728cbad742c85549d504cfcf7a4189b49586d9aaf7b0a715b29bf8875ad716312371c5d4fc838d356ebe22156e1a87eb25e78ce4df7edd91d35526e0
ssdeep: 24576:XJMahBRCPOtZ0Q9m256qEV53I3irri+XugHawdVoDvmKS2gOmdo:XJP/sQ82/srriAugHawdOsOmdo
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2018
InternalName: FastDownloader.exe
FileVersion: 3.2.0.8
CompanyName: -
ProductName: x8f6fx4ef6x4e0bx8f7dx5668
ProductVersion: 3.2.0.8
FileDescription:
OriginalFilename: FastDownloader.exe
Translation: 0x0804 0x04b0

UDS:Downloader.Win32.Agent also known as:

K7AntiVirusRiskware ( 0057e2fa1 )
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
CrowdStrikewin/malicious_confidence_80% (D)
AlibabaRiskWare:Win32/Downer.4b3899b9
K7GWRiskware ( 0057e2fa1 )
CyrenW32/Downer.B.gen!Eldorado
SymantecPUA.Gen.2
ESET-NOD32a variant of Win32/RiskWare.Downer.E
APEXMalicious
AvastWin32:DangerousSig [Trj]
Kasperskynot-a-virus:UDS:Downloader.Win32.Agent
SophosGeneric ML PUA (PUA)
ComodoPacked.Win32.MUPX.Gen@24tbus
McAfee-GW-EditionGenericRXPC-BL!CADB7F161D87
FireEyeGeneric.mg.cadb7f161d87fedd
JiangminDownloader.Agent.ouq
MicrosoftPUA:Win32/Downer
GridinsoftAdware.Agent.sd!c
AhnLab-V3PUP/Win.Downloader.C4528433
McAfeeGenericRXPC-BL!CADB7F161D87
MalwarebytesPUP.Optional.ChinAd
PandaTrj/Genetic.gen
RisingAdware.Downloader!1.D6C8 (CLASSIC)
IkarusPUA.RiskWare.Downer
FortinetRiskware/Downer.DD89
AVGWin32:DangerousSig [Trj]

How to remove UDS:Downloader.Win32.Agent?

UDS:Downloader.Win32.Agent removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment