Categories: Malware

Should I remove “Win32/Injector.AGBF”?

The Win32/Injector.AGBF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.AGBF virus can do?

Sample contains Overlay data
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/Injector.AGBF?


File Info:
name: 09198572E73EBFE458D6.mlwpath: /opt/CAPEv2/storage/binaries/337990faf265d70ba660da2fbbe778e334274a7ffe7a99209618216d473b7b4acrc32: 19988E99md5: 09198572e73ebfe458d6abc40fc0ad50sha1: 8633a9471214f2e454680641106a14252a992c4asha256: 337990faf265d70ba660da2fbbe778e334274a7ffe7a99209618216d473b7b4asha512: 45ed6ff4bfdceafc905a3464ab83d4ceb0d123061abf7e19cae96b53b1d7c40e95989fc23e71e962cb6d3255feb6b3febf88e6394040467613547fc4385afc5dssdeep: 6144:xSmblnHpVcIVjygZic2DRkAbCwTMXO7efs9SiQKQTKdbvozpncYUo0JRm+FYReMr:4mb9Hrcc5iDRPWwI+1hQKQTKpvE10J5Ktype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17164121B87694261D80306F5211CFA6EE9B9EF02626613CF73AC0B7FA790095DDB1DE1sha3_384: 2f6246af15dc6b859454b4ca5630aa6cc266a35ac8c70379c47321e76976ec297b34f4e2900c929ce98c01ce262b6d16ep_bytes: 6880080000680000000068d4734000e8timestamp: 1985-02-27 09:55:21
Version Info:
0: [No Data]

Win32/Injector.AGBF also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.lJ9S
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.16539
FireEye	Generic.mg.09198572e73ebfe4
Cylance	unsafe
VIPRE	Trojan.GenericKDZ.16539
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 004670ce1 )
Alibaba	VirTool:Win32/Injector.eab99c36
K7GW	Trojan ( 004670ce1 )
Cybereason	malicious.2e73eb
VirIT	Trojan.Win32.Generic.AKCQ
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.AGBF
TrendMicro-HouseCall	TROJ_SPNR.32H513
ClamAV	Win.Trojan.16539-3
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.GenericKDZ.16539
NANO-Antivirus	Trojan.Win32.DownLoad3.cqregl
Avast	Win32:Cutwail-BM [Trj]
Tencent	Malware.Win32.Gencirc.10bc0c41
Sophos	Mal/EncPk-AJS
F-Secure	Trojan.TR/Spy.Zbot.ajoumea
DrWeb	Trojan.DownLoad3.8872
Zillya	Trojan.Injector.Win32.198753
TrendMicro	TROJ_SPNR.32H513
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Emsisoft	Trojan.GenericKDZ.16539 (B)
SentinelOne	Static AI – Suspicious PE
GData	Trojan.GenericKDZ.16539
Jiangmin	Trojan/Generic.axzpm
Webroot	W32.Rogue.Gen
Google	Detected
Avira	TR/Spy.Zbot.ajoumea
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Ransom]/Win32.Gimemo
Xcitium	TrojWare.Win32.Injector.AGQG@4xjtt3
Arcabit	Trojan.Generic.D409B
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	VirTool:Win32/Injector.gen!DP
Cynet	Malicious (score: 100)
AhnLab-V3	Spyware/Win32.Zbot.R65481
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.36350.suZ@aKxYA6p
VBA32	BScope.Trojan.Downloader
Malwarebytes	Malware.Heuristic.1008
Panda	Trj/Agent.IVN
APEX	Malicious
Rising	HackTool.Injector!8.1E2 (TFE:5:suc4E6GLWsV)
Ikarus	Trojan.Win32.Tobfy
Fortinet	W32/Zbot.AGWV!tr
AVG	Win32:Cutwail-BM [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)