About “UDS:Rootkit.Win64.Agent.bhc” infection

The UDS:Rootkit.Win64.Agent.bhc is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What UDS:Rootkit.Win64.Agent.bhc virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine UDS:Rootkit.Win64.Agent.bhc?


File Info:
name: 969DC2098E439E237797.mlw
path: /opt/CAPEv2/storage/binaries/bd9a835e3f9021a46ff1ea5ac1c786b43555f74243655170a7653f70d1bfb868
crc32: 72DBCFE8
md5: 969dc2098e439e237797ddf59f3a7390
sha1: c7fdc602e598aa92c7ff207078385a0cc5a8183d
sha256: bd9a835e3f9021a46ff1ea5ac1c786b43555f74243655170a7653f70d1bfb868
sha512: c1ff8954610eddb2dea8c92127ab107f4cd9991c199ab1de0d1b1bd4ca30d0b1c6024926899acb04389f7132c7ccb87f1d93683a616e6dc575bbe741097d71b7
ssdeep: 98304:5+EY0pCh0exTYcw4Qpkr34tCtKrIjxe0ZXSMxPss:5/pIxTYc/QyrotGKsjxFXNxPs
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T1B3368D42E79600F4E977C1388556A33BD7B1B8650370CFDB96A8CA695F23BE11E3A311
sha3_384: 50f3d6be7f725a3211e1324123ac46df39caba1a63abd4f75602d73306d35ae9cd3bbe1aa238be70b9e336114ee72175
ep_bytes: 4883ec28e8970500004883c428e97afe
timestamp: 2021-12-08 01:58:17

Version Info:
0: [No Data]

UDS:Rootkit.Win64.Agent.bhc also known as:

Lionic	Trojan.Win64.Agent.5!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.47597965
McAfee	Artemis!969DC2098E43
Cylance	Unsafe
K7AntiVirus	Trojan ( 00578aba1 )
Alibaba	Trojan:Win64/Kryptik.98ec90cc
K7GW	Trojan ( 00578aba1 )
Cyren	W64/Kryptik.FOQ.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win64/Kryptik.CHJ
Kaspersky	UDS:Rootkit.Win64.Agent.bhc
BitDefender	Trojan.GenericKD.47597965
Avast	Win64:CrypterX-gen [Trj]
Ad-Aware	Trojan.GenericKD.47597965
Sophos	Mal/Generic-S
DrWeb	Trojan.BtcMine.1580
McAfee-GW-Edition	BehavesLike.Win64.InstallMonster.rh
FireEye	Trojan.GenericKD.47597965
Emsisoft	Trojan.GenericKD.47597965 (B)
Ikarus	Trojan.Win64.Crypt
Avira	HEUR/AGEN.1207286
MAX	malware (ai score=87)
Gridinsoft	Ransom.Win64.Sabsik.sa
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
GData	Trojan.GenericKD.47597965
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.47597965
TrendMicro-HouseCall	TROJ_GEN.R002H0AL821
Fortinet	W64/Kryptik.CHJ!tr
AVG	Win64:CrypterX-gen [Trj]
MaxSecure	Trojan.Malware.300983.susgen

How to remove UDS:Rootkit.Win64.Agent.bhc?

UDS:Rootkit.Win64.Agent.bhc removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X