Categories: Trojan

How to remove “Win32/TrojanDownloader.Agent.ATW”?

The Win32/TrojanDownloader.Agent.ATW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.Agent.ATW virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
A process created a hidden window
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Behavioural detection: Injection (inter-process)

How to determine Win32/TrojanDownloader.Agent.ATW?


File Info:
name: 4D265B3E280F3ED5CDD6.mlwpath: /opt/CAPEv2/storage/binaries/01402449d1715eae4a885bd0c79811c507c3cf0c7cd97962239d26a6812fd3f2crc32: 91F5F85Emd5: 4d265b3e280f3ed5cdd6f8c5e0d2b024sha1: ff1e25ca278e72e0171d6a5fd613e9f4569a5dabsha256: 01402449d1715eae4a885bd0c79811c507c3cf0c7cd97962239d26a6812fd3f2sha512: 724665be850b7a14fe5c3b9e266609e065bc7c760760c56a8d47db23bb68068034d936655a9dc62ee5b60e06ac8c5e3de45a92c3c5e8920673dfc09d800775b4ssdeep: 96:1+V5j9SI1WQiNFJ2pKN+XxUKNWnoBcAJWwfTrldonSlpNmujdCzPd+EgN:Yj9SCWQU2pKN+WKNWoB/wwfTrT5mutEtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B512A60A74A48437C66185F048AF1F99DF6EB1B38621F120FF5C29A427602D5D6F216Fsha3_384: 01020a293466925e10d50ea4947d0ce2cdb842cddd7bd06656eee979cb6b80716f657bb2914f3f28a7a1c644a8f563fdep_bytes: e802fbffffe870feffff833dfcb34000timestamp: 2014-05-11 13:09:24
Version Info:
0: [No Data]

Win32/TrojanDownloader.Agent.ATW also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.4d265b3e280f3ed5
Cylance	Unsafe
K7AntiVirus	Trojan-Downloader ( 004ae4d51 )
Alibaba	TrojanDownloader:Win32/Generic.04e9ba0c
K7GW	Trojan-Downloader ( 004ae4d51 )
BitDefenderTheta	Gen:NN.ZexaF.34606.amW@aa76Abf
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.ATW
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Mlw.fvfkzw
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan-downloader.Agent.Pdmk
F-Secure	Heuristic.HEUR/AGEN.1205074
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Spy
Avira	HEUR/AGEN.1205074
Microsoft	Trojan:Win32/Zpevdo.B
Cynet	Malicious (score: 100)
McAfee	Artemis!4D265B3E280F
VBA32	BScope.Trojan.Wacatac
Rising	Downloader.Agent!8.B23 (CLOUD)
Yandex	Trojan.Agent!ur0/fayw6k0
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Agent.ATW!tr.dldr
AVG	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_60% (W)