Categories: Trojan

Win32/TrojanDownloader.Agent.FFX (file analysis)

The Win32/TrojanDownloader.Agent.FFX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.Agent.FFX virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
Authenticode signature is invalid
Attempts to modify proxy settings
Creates a copy of itself
Harvests cookies for information gathering

How to determine Win32/TrojanDownloader.Agent.FFX?


File Info:
name: 16820A746B4DEEAAFC4A.mlwpath: /opt/CAPEv2/storage/binaries/a2ac87ac97114e24c11699b7c8669a70f878d055d37cc9c7198d6b0a1139da5dcrc32: E57C0975md5: 16820a746b4deeaafc4a1132745416cesha1: 25b524812f359325fd47c3c432541ea35b36052csha256: a2ac87ac97114e24c11699b7c8669a70f878d055d37cc9c7198d6b0a1139da5dsha512: 35da9671a9dbc57ebb1193e6004631e5ec0cc6cb1c673652cdc79e6ba2462a258eeec68c202844c8bf58d7aced17ff4d0e097594cb36cadc7230e3598e163522ssdeep: 6144:lisar3olTCzOanFgQmoq8fDVTzuGUs989iAOA+ukC4:lXjTCzOanFgf+TzuGUsqc2D4type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T199248D1175E2C473D5B2153008F8DB751A3DBC314F619AEBA3D40B7E8F342C2A676A6Asha3_384: 4f2c2c94d946df783945dbd7fa555480e46b9c780823dea5112de29db7dd60f7193ff1f802934794e3303ec76a364073ep_bytes: e87a040000e97afeffff558bec8b4508timestamp: 2020-06-30 14:37:00
Version Info:
CompanyName: Noriyuki MiyazakiFileDescription: CrystalDiskInfoFileVersion: 8.2019.0.0InternalName: DiskInfo.exeLegalCopyright: (C) 2008-2019 hiyohiyoOriginalFilename: DiskInfo.exeProductName: CrystalDiskInfoProductVersion: 8.3.2.2019Translation: 0x0407 0x04b0

Win32/TrojanDownloader.Agent.FFX also known as:

Bkav	W32.AIDetect.malware2
Lionic	Heuristic.File.Generic.00×1!p
DrWeb	Trojan.Inject3.45295
McAfee	Artemis!16820A746B4D
Malwarebytes	Trojan.Downloader
Sangfor	PUP.Win32.Johnnie.258676
K7AntiVirus	Trojan-Downloader ( 0056b46d1 )
K7GW	Trojan-Downloader ( 0056b46d1 )
Cybereason	malicious.46b4de
BitDefenderTheta	Gen:NN.ZexaE.34698.nu0@aWKqm3zi
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.FFX
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-Dropper.Win32.Scrop.adiy
Alibaba	TrojanDropper:Win32/Scrop.b8a28596
NANO-Antivirus	Trojan.Win32.Scrop.hpndgl
Avast	Win32:Malware-gen
Rising	Trojan.Generic@AI.91 (RDML:WH5G+wshY4jKwMaK0QWVUA)
Comodo	Malware@#2fhj5o40hzav2
F-Secure	Trojan.TR/Dldr.Agent.biljx
Zillya	Downloader.Agent.Win32.414052
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Trojan-Downloader.Win32.Agent
Google	Detected
Avira	TR/Dldr.Agent.biljx
Antiy-AVL	Trojan[Dropper]/Win32.Scrop
ZoneAlarm	Trojan-Dropper.Win32.Scrop.adiy
Microsoft	Trojan:Win32/Occamy.B
Cynet	Malicious (score: 100)
VBA32	BScope.Trojan.Wacatac
Cylance	Unsafe
Tencent	Win32.Trojan-Dropper.Scrop.Eflw
Yandex	Trojan.DR.Scrop!Q4+m5GZ5pjs
MaxSecure	Trojan.Malware.104338550.susgen
Fortinet	W32/Agent.FFX!tr
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)