Categories: Malware

About “Win32/Agent.VAZ” infection

The Win32/Agent.VAZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Agent.VAZ virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
At least one process apparently crashed during execution
Anomalous file deletion behavior detected (10+)
Dynamic (imported) function loading detected
Starts servers listening on 127.0.0.1:0
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Behavioural detection: Transacted Hollowing
Installs itself for autorun at Windows startup
Creates a hidden or system file
Uses suspicious command line tools or Windows utilities

How to determine Win32/Agent.VAZ?


File Info:
name: 9589497ECDF782102515.mlwpath: /opt/CAPEv2/storage/binaries/56604ca2b5291e067a16d62ad9f45acc11c14b77f799de40ff82cc6ba156055acrc32: 62D190E6md5: 9589497ecdf782102515421f9d487904sha1: 655d7b5f4ba2474ee611d02df2d05dc3a219251asha256: 56604ca2b5291e067a16d62ad9f45acc11c14b77f799de40ff82cc6ba156055asha512: a749c5b5cb447444dd5cb33ccdb068b563a788fcc2d7445ac59d2e50bdee205f12c8561646afa87df90c915ff81ae3206ea510ad5e7e3c2110b6a0e4c6a3d3dcssdeep: 12288:i5TpNMSFge0Wieq2cS3qMebx+nOkqV7hV+hgj0TiqqLufY/f11owzIRqci0oM7bn:iDNMSR8tH+viLufY/f1uRv7hkQAH2XGmtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17FF4BF61BD8180B3E2A110B565B9EB370E3CA9244711A9D3E3C05E7C9D316E1AF3B75Dsha3_384: b796e06d3919a2622a0b6907f1496d9e2352d3716451941e34eca8dd15349d7fd3f477ae5658990ffc69f19690977cc5ep_bytes: e8c80a0000e974feffffe9eecf0000e9timestamp: 2022-04-24 14:09:10
Version Info:
0: [No Data]

Win32/Agent.VAZ also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent.VAZ
APEX	Malicious
Kaspersky	VHO:Trojan-Banker.Win32.ClipBanker.gen
F-Secure	Heuristic.HEUR/AGEN.1237910
BitDefenderTheta	Gen:NN.ZexaF.34606.VuW@aql0@vmi
McAfee-GW-Edition	BehavesLike.Win32.Generic.bh
FireEye	Generic.mg.9589497ecdf78210
Sophos	Generic ML PUA (PUA)
Avira	HEUR/AGEN.1237910
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
AhnLab-V3	Trojan/Win.Generic.C5100471
Acronis	suspicious
Rising	Trojan.Generic@AI.83 (RDMK:cmRtazpz2q2mL/mAZ2FF6c3k2SqE)
SentinelOne	Static AI – Malicious PE
Cybereason	malicious.f4ba24