Categories: Malware

Win32/Agent.ADSS removal tips

The Win32/Agent.ADSS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Agent.ADSS virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid

How to determine Win32/Agent.ADSS?


File Info:
name: 0633B2357D143763773A.mlwpath: /opt/CAPEv2/storage/binaries/65039cad3067540b2e0c950d3050f371267e0edc2e28d7f0fb4eb2e22d2c6b0dcrc32: B17E73E8md5: 0633b2357d143763773ace9710f88febsha1: 464c8db0b1214eb97bf834b2288a1a5d9cd88413sha256: 65039cad3067540b2e0c950d3050f371267e0edc2e28d7f0fb4eb2e22d2c6b0dsha512: 646da632b767608268bc4d0421fd5256fc84e5e4f15e8b173029822696b437fd7958743d0b9a04040800576c4f259e1cd5be4b3d74c5834ae6337b8422ede7c9ssdeep: 384:iPYrGverXCI87Mopo+mGRg5mYJLDCRbCh1IX1c:lGof8womDJLQbCgFctype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1EB7217473A5734A3EA560F7090F7D6368F35B3702FD060DBA0B289B91D757A13E2950Asha3_384: b3928c0703b4a1ab3528d4e1f0a0c14322d209b82ee01f4af1da2adfe249dcba7829cc85552667412835086112b11ea6ep_bytes: e85d030000e9cdfdffff8bff558bec81timestamp: 2021-12-05 03:09:59
Version Info:
CompanyName: TODO: FileDescription: TODO: FileVersion: 1.0.0.1InternalName: Loder.exeLegalCopyright: Copyright (C) 2021OriginalFilename: Loder.exeProductName: TODO: ProductVersion: 1.0.0.1Translation: 0x0804 0x04b0

Win32/Agent.ADSS also known as:

FireEye	Generic.mg.0633b2357d143763
Cylance	Unsafe
K7AntiVirus	Trojan ( 0058b8a81 )
Alibaba	Trojan:Win32/Zenpak.5ab7632a
K7GW	Trojan ( 0058b8a81 )
Cybereason	malicious.0b1214
BitDefenderTheta	Gen:NN.ZexaF.34084.bu1@a8oKvAlb
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Agent.ADSS
TrendMicro-HouseCall	TROJ_GEN.R002C0PLA21
Kaspersky	HEUR:Trojan.Win32.Zenpak.gen
Avast	Win32:TrojanX-gen [Trj]
Comodo	TrojWare.Win32.TrojanProxy.Horst.~O@f80r9
TrendMicro	TROJ_GEN.R002C0PLA21
McAfee-GW-Edition	RDN/BackDoor-CMQ
Sophos	Mal/Generic-S + Mal/Horst-E
Ikarus	Trojan.Win32.Agent
Avira	TR/Agent.nbvsz
Antiy-AVL	Trojan/Generic.ASMalwS.34E8020
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
McAfee	RDN/BackDoor-CMQ
VBA32	BScope.Trojan.Agent
Yandex	Trojan.DL.Agent!It5I7/Hs/0A
Fortinet	W32/Agent.ADSS!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_70% (W)