Trojan

Should I remove “Win32/TrojanDownloader.Agent.GCA”?

Malware Removal

The Win32/TrojanDownloader.Agent.GCA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32/TrojanDownloader.Agent.GCA virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • HTTPS urls from behavior.
  • Enumerates running processes
  • Authenticode signature is invalid
  • Installs itself for autorun at Windows startup
  • Attempts to modify proxy settings

How to determine Win32/TrojanDownloader.Agent.GCA?



File Info:

name: E5F25032E2A1A0F2F2FC.mlw
path: /opt/CAPEv2/storage/binaries/fdcacae270d8781441d1716078f280d918969fb4dc73410954e98d3cffa1064e
crc32: 7CE405F2
md5: e5f25032e2a1a0f2f2fc2c9bfa28037b
sha1: 1b1425b932a40b3626b65a90ada40dc0d32b1c68
sha256: fdcacae270d8781441d1716078f280d918969fb4dc73410954e98d3cffa1064e
sha512: 17030f9e43d74f8a9c2f4f1977ba68b7aed08279bc0e7146fe2613a0c4fd2ade4bbd0de074ace3492e05e932d4a0e500c4b4dbb4b7ad21551569f5639f0bbe9a
ssdeep: 96:RdN+FZiRqIFNhFJpGCsat1uMtN8xtAhDwzqlkdRJpjh36jXuLYYJpjpSNAwljGEK:RdNcGJHusCVHPPH0iwFftzEAOoiPBWE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14A42090277B45122EBE50531553F46B5803BBE34079AA9EB7275B64806B92E0F93A13F
sha3_384: b80aac91240466cada07e3dd9b9717f5aac2de3054e06c837c245452519c750af781570a21950db2358815270545781a
ep_bytes: e8c5010000e949feffffccff25b03040
timestamp: 2022-01-20 11:33:26


Version Info:

0: [No Data]

Win32/TrojanDownloader.Agent.GCA also known as:

LionicWorm.Win32.Guap.q!c
FireEyeGeneric.mg.e5f25032e2a1a0f2
CylanceUnsafe
ZillyaDownloader.Agent.Win32.460749
SangforWorm.Win32.Guap.dh
K7AntiVirusTrojan-Downloader ( 0058d9c31 )
K7GWTrojan-Downloader ( 0058d9c31 )
BitDefenderThetaGen:NN.ZexaF.34212.auW@aqijUDai
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/TrojanDownloader.Agent.GCA
Paloaltogeneric.ml
KasperskyIM-Worm.Win32.Guap.dh
AvastWin32:Trojan-gen
TencentWin32.Worm-im.Guap.Amvq
McAfee-GW-EditionBehavesLike.Win32.Generic.lm
SophosMal/Generic-S
GDataWin32.Trojan-Downloader.Generic.05RU8Z
Antiy-AVLTrojan/Generic.ASMalwS.3518DB1
ZoneAlarmIM-Worm.Win32.Guap.dh
MicrosoftTrojan:Win32/Wacatac.B!ml
McAfeeArtemis!E5F25032E2A1
VBA32Worm.Guap
APEXMalicious
RisingWorm.Guap!8.BB2 (CLOUD)
IkarusTrojan-Downloader.Win32.Agent
FortinetW32/Agent.GCA!tr.dldr
AVGWin32:Trojan-gen

How to remove Win32/TrojanDownloader.Agent.GCA?

Win32/TrojanDownloader.Agent.GCA removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment