Categories: Malware

Should I remove “Win32:Agent-ASRB [Trj]”?

The Win32:Agent-ASRB [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:Agent-ASRB [Trj] virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32:Agent-ASRB [Trj]?


File Info:
name: B9E6C03FA3F34313B45F.mlwpath: /opt/CAPEv2/storage/binaries/2b332d519761e4f4a9d70fdbc93a5ecbf80895ca25fbb176f2a49ffdfe413bfccrc32: E249EC52md5: b9e6c03fa3f34313b45f0bc106738a6esha1: 09edc8aa1704446b403a45bfe07229e3e8b79e13sha256: 2b332d519761e4f4a9d70fdbc93a5ecbf80895ca25fbb176f2a49ffdfe413bfcsha512: 9ad961054b62136330790b99539772ef6c64fbba2947361d7d9f81e4a0df8425ffa1d6af4d279aeb0aa28b30a28233806cd2e9e212f2bd4cc85556ab007fcdebssdeep: 12288:uOiVYR9C8Pe4U7O7l+VrQSdtKLdoUgQsB2knPB:yifW4Ll6Q4+doUgQFitype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E394024F6F90A141E374263DC9FB44A1633971968D4F2FEB21C6798208D39D1342BBAEsha3_384: c68dcfa24b9758bc252a63e3e75684d7ab6fcaf9e6d2ae901418f735e76c5ea6d23bdb62eddde120ecf25958c774e4c2ep_bytes: 83ec346a006a0089c0ff159431450068timestamp: 2004-04-02 03:25:40
Version Info:
Comments: CompanyName: MSР« CorpFileDescrsiption: goС‹.exeFileVersion: 5.2.1.2InternalName: go.exeLegalCopyright: Copyright (C) 2010LegalTrademarks: LegalOriginalFilename: gog.exePrivateBuild: ProductName: GoС‰ProductVersion: 5.2.1.3SpecialBuild: Translation: 0x0800 0x0026

Win32:Agent-ASRB [Trj] also known as:

Bkav	W32.FamVT.ZbotbND.Trojan
Elastic	malicious (high confidence)
ClamAV	Win.Trojan.Generic-6260467-0
CAT-QuickHeal	TrojanDownloader.Upatre.A5
McAfee	PWSZbot-FLJ!B9E6C03FA3F3
Cylance	Unsafe
Zillya	Trojan.Inject.Win32.64515
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 0040f6bd1 )
BitDefender	Gen:Variant.Razy.803601
K7GW	Trojan-Downloader ( 0040f6bd1 )
Cybereason	malicious.fa3f34
Baidu	Win32.Trojan.Kryptik.mp
VirIT	Trojan.Win32.Generic.CIE
Cyren	W32/SmallTrojan.AZ.gen!Eldorado
Symantec	Trojan.Zbot!gen65
ESET-NOD32	Win32/Spy.Zbot.AAU
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Inject.cmpcox
MicroWorld-eScan	Gen:Variant.Razy.803601
Rising	Trojan.Generic@AI.100 (RDML:J30kCMeoVKB6nGoPmoMxvw)
Ad-Aware	Gen:Variant.Razy.803601
TACHYON	Trojan/W32.Inject.440320.E
Sophos	ML/PE-A + Mal/EncPk-ZC
Comodo	TrojWare.Win32.Kryptik.BUO@545v1i
DrWeb	Trojan.PWS.Panda.4379
VIPRE	Gen:Variant.Razy.803601
TrendMicro	TSPY_ZBOT.SMZT
McAfee-GW-Edition	PWSZbot-FLJ!B9E6C03FA3F3
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.b9e6c03fa3f34313
Emsisoft	Gen:Variant.Razy.803601 (B)
Ikarus	Trojan.Crypt.XDropper
GData	Win32.Trojan.PSE1.ZTTVO6
Jiangmin	TrojanSpy.Zbot.dxul
Webroot	W32.InfoStealer.Zeus
Avira	TR/Yarwi.AD.3
Antiy-AVL	Trojan/Generic.ASMalwS.77
Arcabit	Trojan.Razy.DC4311
SUPERAntiSpyware	Trojan.Agent/Gen-Dropper
Microsoft	PWS:Win32/Zbot!GO
Google	Detected
AhnLab-V3	Trojan/Win32.Zbot.R87613
BitDefenderTheta	Gen:NN.ZexaF.34592.Au0@aGrkqFh
ALYac	Gen:Variant.Razy.803601
MAX	malware (ai score=83)
VBA32	BScope.TrojanPSW.Panda
Malwarebytes	Trojan.Dropper
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TSPY_ZBOT.SMZT
Tencent	Malware.Win32.Gencirc.10c6bb72
Yandex	Trojan.Inject!k6zJPxEY0H4
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Small.BS!tr.dldr
AVG	Win32:Agent-ASRB [Trj]
Avast	Win32:Agent-ASRB [Trj]
CrowdStrike	win/malicious_confidence_100% (W)