Win32/Agent.AAIY information

The Win32/Agent.AAIY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Agent.AAIY virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Attempts to connect to a dead IP:Port (4 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Starts servers listening on 0.0.0.0:13141
Performs some HTTP requests
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Installs itself for autorun at Windows startup
Creates a hidden or system file

Related domains:

z.whorecord.xyz

a.tomx.xyz

r.nxxxn.ga

fuck88.f3322.net

tbip.alicdn.com

How to determine Win32/Agent.AAIY?


File Info:
crc32: 75C4A25F
md5: aca39cd1860e4f1b485ae02020e3d905
name: ACA39CD1860E4F1B485AE02020E3D905.mlw
sha1: 1682bc01e047559c6b6b6dd40dbd08f2a83d2ab0
sha256: f8364fa6b0be99fd1449761fc65cd7cb7abf67ad6fd3b1c8f38a973aa9491a3a
sha512: c7da7273d3c35bf9b026c1660370fbc56735f3265cd20393d7c7be32f935f66d8147be37571391c0f3dc014f913caaed09cbf17a02c41693be654b9e9b642f2a
ssdeep: 24576:AB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:ABSDnV3XRfJ/emAUscMoCVuw
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: Mozilla Corporation
FileVersion: 74.0
CompanyName: Mozilla Corporation
LegalTrademarks: Firefox is a Trademark of The Mozilla Foundation.
ProductName: Firefox
ProductVersion: 74.0
FileDescription: Mozilla Maintenance Service Installer
OriginalFilename: maintenanceservice_installer.exe
Translation: 0x0409 0x04b0

Win32/Agent.AAIY also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Graftor.494720
FireEye	Generic.mg.aca39cd1860e4f1b
CAT-QuickHeal	Trojan.Mauvaise.SL1
ALYac	Gen:Variant.Graftor.494720
Malwarebytes	Backdoor.Farfli.UPX
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
CrowdStrike	win/malicious_confidence_60% (D)
BitDefender	Gen:Variant.Graftor.494720
K7GW	Trojan ( 00531ee81 )
K7AntiVirus	Trojan ( 00531ee81 )
Cyren	W32/Agent.BTG.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Evo-gen [Susp]
Kaspersky	Trojan.Win32.Agent.xafddl
NANO-Antivirus	Trojan.Win32.BlackMoon.flthzb
Rising	Backdoor.Farfli!8.B4 (TFE:5:5jAUp50zBjO)
Ad-Aware	Gen:Variant.Graftor.494720
Sophos	ML/PE-A + Troj/Agent-BEJP
Comodo	Backdoor.Win32.Zegost.XP@7o7w19
F-Secure	Trojan.TR/Crypt.Agent.uzqab
DrWeb	BackDoor.BlackMoon.15
Zillya	Worm.Palevo.Win32.124018
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Emsisoft	Gen:Variant.Graftor.494720 (B)
Jiangmin	Trojan.Blamon.afk
Webroot	W32.Blamon
Avira	TR/Crypt.Agent.uzqab
Antiy-AVL	Trojan/Win32.APosT
Microsoft	Backdoor:Win32/Farfli
Gridinsoft	Trojan.Win32.Kryptik.ba!s2
SUPERAntiSpyware	Trojan.Agent/Gen-Graftor
ZoneAlarm	Trojan.Win32.Agent.xafddl
GData	Gen:Variant.Graftor.494720
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.RL_Farfli.R333331
McAfee	GenericRXAA-AA!ACA39CD1860E
VBA32	Trojan.APosT
ESET-NOD32	Win32/Agent.AAIY
Tencent	Malware.Win32.Gencirc.10b9c3db
Yandex	Trojan.Kryptik!ikbLLfr6/RE
MAX	malware (ai score=88)
Fortinet	W32/Kryptik.GGXP!tr
BitDefenderTheta	Gen:NN.ZexaF.34780.lnKfaqS@24ij
AVG	Win32:Evo-gen [Susp]
Cybereason	malicious.1860e4
Qihoo-360	HEUR/QVM11.1.F1C9.Malware.Gen

How to remove Win32/Agent.AAIY?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Agent.AAIY information