What is “Win32/Spy.Agent.QAK”?

The Win32/Spy.Agent.QAK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Spy.Agent.QAK virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Spy.Agent.QAK?


File Info:
name: 8CCE90C99E7689956AAA.mlw
path: /opt/CAPEv2/storage/binaries/2f7dcaa0aca748a4def195b4985e776ef10478045b37fe676bcb19858a580570
crc32: 40999DF4
md5: 8cce90c99e7689956aaa7012656df293
sha1: 3ef560340482d025553809379bbe3a4a5750b44b
sha256: 2f7dcaa0aca748a4def195b4985e776ef10478045b37fe676bcb19858a580570
sha512: 79c58a036e591ce7f842d643e5f1185aa318efc6bad8882429cb5f0fb2c0846acea19e2b5dc3e15a4407134b6430c7643de3245d7c4597782eb58863429b0d3a
ssdeep: 6144:NKnwpF10ti2yfFZ1ZL/9ji1nHUH0RlwMyLkwO45wwAnLmbUM3l/di:vmcfFZ1ZL/FeyLkwO45tILmbUM3Di
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T102849C10B525C174D4A900F4B5EE7B9F243C5EAC531848D3B3E8189AABF05E35AF5BA3
sha3_384: ab18f23521be951e01d82d816d17cd1def9b5046a8327971b14aee80c9f84bd8878169d03a175fd4b174eb27a2b22d9f
ep_bytes: 558bec837d0c017505e843040000ff75
timestamp: 2017-07-02 19:29:18

Version Info:
0: [No Data]

Win32/Spy.Agent.QAK also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Zenpak.4!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.8cce90c99e768995
Skyhigh	PUP-GJD
McAfee	PUP-GJD
Cylance	unsafe
Zillya	Trojan.Agent.Win32.2429665
Sangfor	Spyware.Win32.Agent.Vitx
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Spy.Agent.QAK
ClamAV	Win.Trojan.Ursu-9780309-0
Kaspersky	HEUR:Trojan.Win32.Zenpak.gen
Avast	Win32:SpywareX-gen [Trj]
Tencent	Win32.Trojan.Zenpak.Wwhl
F-Secure	Heuristic.HEUR/AGEN.1303164
TrendMicro	TROJ_GEN.R002C0PAN24
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Win32.Application.GameHack.Q
Jiangmin	Trojan.Zenpak.jwd
Webroot	W32.Malware.Gen
Google	Detected
Avira	HEUR/AGEN.1303164
Varist	W32/S-1ff34825!Eldorado
Antiy-AVL	Trojan/Win32.TSGeneric
ZoneAlarm	HEUR:Trojan.Win32.Zenpak.gen
Microsoft	Trojan:Win32/Tiggre!rfn
Cynet	Malicious (score: 100)
VBA32	Trojan.Zenpak
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_GEN.R002C0PAN24
Rising	Trojan.Generic@AI.95 (RDMK:cu6kAn0h/M3pD6kYnFUMjg)
Yandex	Trojan.Igent.bUFXDs.37
Ikarus	Trojan.Graftor
MaxSecure	Trojan.Malware.73832973.susgen
Fortinet	Riskware/Reflective
AVG	Win32:SpywareX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Win32/Spy.Agent.QAK?

Win32/Spy.Agent.QAK removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X