Win32/TrojanDropper.Agent.NCD information

The Win32/TrojanDropper.Agent.NCD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDropper.Agent.NCD virus can do?

• Sample contains Overlay data
• HTTPS urls from behavior.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Operates on local firewall’s policies and settings
• Deletes executed files from disk
• Attempts to disable Windows Auto Updates
• The sample wrote data to the system hosts file.
• Attempts to modify or disable Security Center warnings
• Modifies Image File Execution Options, indicative of process injection or persistence
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/TrojanDropper.Agent.NCD?

File Info:
name: 75C3DDA16A0F76C69EA8.mlw
path: /opt/CAPEv2/storage/binaries/5fa26aaa31483f12a9d9411a48b71216ab7b242f46cc71a1d07dfc26b9b48ece
crc32: C05BF233
md5: 75c3dda16a0f76c69ea843bc33f3baea
sha1: 917bd0fa9fb8eb059608965ead2fb76b71ab9370
sha256: 5fa26aaa31483f12a9d9411a48b71216ab7b242f46cc71a1d07dfc26b9b48ece
sha512: 174f1a7ba078b0b010389ccb10e99a73941305cd1a320db725fa000ea1cf463be7d154af8c0e381c469a55d4bd585eab97f9dffe6db959e0b2486488e47a891b
ssdeep: 384:jIz443QKj5PSEzOJS0rEPAexyQVogZrY2+7BmsnWmDFho3y25YO:jIUSbS0gFYPAexyQSgOj7IDBiO
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15592C07B682B1E92C048AB7190D3FC9343E7DF6C52632D3D598716D14A6A30EF6B014D
sha3_384: 5700f9931250228371cbe5d81e40e3b07453c193613e3da559365047d1d7128fd39b2c2fd6a0a447a96239d183596246
ep_bytes: 55ba0010400057565381ec740500008d
timestamp: 2006-07-01 19:13:13

Version Info:
0: [No Data]

Win32/TrojanDropper.Agent.NCD also known as:

How to remove Win32/TrojanDropper.Agent.NCD?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.