Categories: Malware

Should I remove “Win32:Agent-IAT [Trj]”?

The Win32:Agent-IAT [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:Agent-IAT [Trj] virus can do?

At least one process apparently crashed during execution
Creates RWX memory
Dynamic (imported) function loading detected
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Executed a process and injected code into it, probably while unpacking
Behavioural detection: Injection (inter-process)
Installs itself for autorun at Windows startup

How to determine Win32:Agent-IAT [Trj]?


File Info:
name: 800CB99943652B015738.mlwpath: /opt/CAPEv2/storage/binaries/004b5f52b5c8a43d8a6012c1a1827b65c57671bb2dbfa1aee1920a7f153abeb2crc32: D6D4D583md5: 800cb99943652b0157385c159a3b36acsha1: d3bef955a0cdeeef8129b4a3acbad6c58e06213esha256: 004b5f52b5c8a43d8a6012c1a1827b65c57671bb2dbfa1aee1920a7f153abeb2sha512: bb2da648d7f1966b3d61afa4899ef03774faa771df07789147bc9c82ea952391b12e2a60ac39d2464d6d798adf2703442eb24e460ac99ff87d527dc4a98b9d41ssdeep: 1536:q5neEhlcTW5sk1jtf2XvWINndIcN6JDQs5g7j6tbsvf+4XCs03:Inj9jtfU+INndIc0Jt5io+1XCs03type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1C5834A1297E4813BE0F537B049FE12632779BCE06B79A39F824954D95C717C0AA7832Bsha3_384: 00f84d49f0f001f5cd027eba2b2be31f803e6532ebb136cbe94bba3903d4a8aced69d417f8a56cee403f72990a9f4009ep_bytes: e80a000000e97affffffcccccccccc8btimestamp: 2004-08-04 06:01:37
Version Info:
CompanyName: Microsoft CorporationFileDescription: Win32 Cabinet Self-Extractor                                           FileVersion: 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)InternalName: Wextract                LegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: WEXTRACT.EXE            ProductName: Microsoft® Windows® Operating SystemProductVersion: 6.00.2900.2180Translation: 0x0409 0x04b0

Win32:Agent-IAT [Trj] also known as:

DrWeb	BackDoor.Beizhu.2077
MicroWorld-eScan	Trojan.Delf.Inject.Z
FireEye	Trojan.Delf.Inject.Z
ALYac	Trojan.Delf.Inject.Z
Cylance	Unsafe
Cybereason	malicious.943652
BitDefenderTheta	AI:Packer.699B17281F
Cyren	W32/DelfInject.A.gen!Eldorado
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDropper.ErPack
ClamAV	Win.Trojan.Agent-108147
Kaspersky	Trojan-Dropper.Win32.Delf.pz
BitDefender	Trojan.Delf.Inject.Z
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	Win32:Agent-IAT [Trj]
Ad-Aware	Trojan.Delf.Inject.Z
Emsisoft	Trojan.Delf.Inject.Z (B)
Comodo	Backdoor.Win32.Agent.~BAAQ@fy48
F-Secure	Trojan.TR/Hijacker.Gen
McAfee-GW-Edition	BehavesLike.Win32.PWSMmorpg.mh
Sophos	ML/PE-A + Mal/Dropper-G
SentinelOne	Static AI – Malicious SFX
GData	Trojan.Delf.Inject.Z
Jiangmin	Trojan/Chifrax.bse
Webroot	Trojan.Dropper.Gen
Avira	TR/Hijacker.Gen
MAX	malware (ai score=87)
Arcabit	Trojan.Delf.Inject.Z
ZoneAlarm	Trojan-Dropper.Win32.Delf.pz
Microsoft	Backdoor:Win32/Bladabindi!ml
Cynet	Malicious (score: 100)
McAfee	Artemis!800CB9994365
VBA32	Malware-Dropper.Win32.ICrypt
Malwarebytes	Malware.Heuristic.1001
APEX	Malicious
Rising	Trojan.Win32.Generic.13684163 (C64:YzY0Okq17K7IuDph)
Yandex	Trojan.GenAsa!ZPpJDROlT74
Ikarus	Trojan.Hijacker
Fortinet	W32/Injector.fam!tr
AVG	Win32:Agent-IAT [Trj]