Categories: Trojan

UDS:Trojan-Downloader.Win32.Agent.silfjd information

The UDS:Trojan-Downloader.Win32.Agent.silfjd is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What UDS:Trojan-Downloader.Win32.Agent.silfjd virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
HTTPS urls from behavior.
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Attempts to modify proxy settings

How to determine UDS:Trojan-Downloader.Win32.Agent.silfjd?


File Info:
name: B5C5B2576D2999C586A9.mlwpath: /opt/CAPEv2/storage/binaries/ee7878efff61c87eaa282c745ccb6f12da550c9a6c284ef4ad62cc34ef379dfacrc32: A41CCC73md5: b5c5b2576d2999c586a931ff4d3fab5dsha1: 2493186b57aa3dd0b4e70954eb5ef1fdab14ed28sha256: ee7878efff61c87eaa282c745ccb6f12da550c9a6c284ef4ad62cc34ef379dfasha512: 2fd1ff5a6284e3d95413b2b4a6c392ac79f254040dc42e0ae925b1c9e370729f4b5879a65130444618f22daa940e50130aed0589132fd1b54040ac7a7add985essdeep: 49152:nJ3xwUDzMZM+xYm1yp7d+s8KuqGaX0ToIBAUZLYY:JhwUk1ypaJBAUZL3type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T18D75CF52F783C5BAE53389304C6A6B3B962BEE120F059B837364FF4D1D73290997611Asha3_384: ad598b70fc88e48e2f192944dd0532121bfe82d68e774718ee346ff3e3819503201f4f16d428a60ff7706968a83e4d94ep_bytes: 558bec6aff68c0c6570068cc59470064timestamp: 2018-08-14 07:59:54
Version Info:
FileVersion: 1.0.0.0FileDescription: 易语言程序ProductName: 易语言程序ProductVersion: 1.0.0.0LegalCopyright: 作者版权所有 请尊重并使用正版Comments: 本程序使用易语言编写(http://www.eyuyan.com)Translation: 0x0804 0x04b0

UDS:Trojan-Downloader.Win32.Agent.silfjd also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Agent.a!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.b5c5b2576d2999c5
McAfee	GenericRXAA-AA!B5C5B2576D29
Cylance	Unsafe
Sangfor	Trojan.Win32.Agent.silfjd
K7AntiVirus	Trojan ( 005246d51 )
Alibaba	Backdoor:Win32/Farfli.c381f683
K7GW	Adware ( 004b87ea1 )
CrowdStrike	win/malicious_confidence_60% (D)
BitDefenderTheta	Gen:NN.ZexaF.34212.Nr0@a0Ix6Hpb
Cyren	W32/Agent.EW.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX	Malicious
ClamAV	Win.Malware.Flystudio-9752414-0
Kaspersky	UDS:Trojan-Downloader.Win32.Agent.silfjd
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan-downloader.Agent.Pgwj
Sophos	Mal/Generic-S
Comodo	Worm.Win32.Dropper.RA@1qraug
F-Secure	Trojan.TR/Crypt.XPACK.Gen7
DrWeb	BackDoor.PcClient.6543
TrendMicro	TROJ_GEN.R03BC0DB322
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Ikarus	Trojan.Win32.MBRlock
Jiangmin	Trojan/PSW.QQPass.mra
Avira	TR/Crypt.XPACK.Gen7
Antiy-AVL	Trojan/Win32.FlyStudio.a
Gridinsoft	Ransom.Win32.Miner.sa
Microsoft	Backdoor:Win32/Farfli.CT!bit
ViRobot	Trojan.Win32.Z.Farfli.1699840.A
ZoneAlarm	Trojan-Downloader.Win32.Agent.silfjd
GData	Win32.Trojan.PSE.1THOGOA
Cynet	Malicious (score: 100)
Acronis	suspicious
VBA32	BScope.Backdoor.Farfli
Malwarebytes	PUP.Optional.ChinAd
TrendMicro-HouseCall	TROJ_GEN.R03BC0DB322
Rising	Backdoor.Farfli!8.B4 (CLOUD)
Yandex	Trojan.DL.Agent!41+5d83ObLI
SentinelOne	Static AI – Malicious PE
MaxSecure	Dropper.Dinwod.frindll
Fortinet	W32/CoinMiner.65CA!tr
AVG	Win32:Trojan-gen
Cybereason	malicious.b57aa3