Win32/TrojanDropper.Agent.SPA malicious file

The Win32/TrojanDropper.Agent.SPA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDropper.Agent.SPA virus can do?

• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Uses suspicious command line tools or Windows utilities

How to determine Win32/TrojanDropper.Agent.SPA?

File Info:
name: 9ED0BA421EB8F75F274B.mlw
path: /opt/CAPEv2/storage/binaries/6d6718bf862d41c6065689ebb366675f219fe81ce4789a121739f164631d6e90
crc32: 480D9E01
md5: 9ed0ba421eb8f75f274b482e24f379a9
sha1: 182f298893a4592353e47c786fda24ca3130aa85
sha256: 6d6718bf862d41c6065689ebb366675f219fe81ce4789a121739f164631d6e90
sha512: 9904294bd70cfdf672a801bc8400aabd593a54bef3d2d018f06429eaa9ee7700a47d5bcf8873cb5a9a3b488037302267e4cf6be4c4d27528f6ed6a9583aa87f7
ssdeep: 384:4pO214bF/2KqeIsCIZKkXmccmVwYAlHcK5v6dMDjxH:wO2+PPCItmcVFg52MvxH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12662D0EBFE6E8C97EE89633630D38569E4B1E0220146D782E11407D72D2C0D598B2E1C
sha3_384: 01c6748a1c607875cfe3aa5b474d5fc09434174e4a1c316b8782514c92f09183fa722f46695a8691e830ee5752e56fd0
ep_bytes: 60be154041008dbeebcffeff5783cdff
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Win32/TrojanDropper.Agent.SPA also known as:

How to remove Win32/TrojanDropper.Agent.SPA?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.