Malware

About “Win32:Agent-URR [Trj]” infection

Malware Removal

The Win32:Agent-URR [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32:Agent-URR [Trj] virus can do?

  • Executable code extraction
  • At least one process apparently crashed during execution
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (5 unique times)
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Uses Windows utilities for basic functionality
  • Sniffs keystrokes
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

www.bing.com
ocsp.digicert.com
crl3.digicert.com

How to determine Win32:Agent-URR [Trj]?


File Info:

crc32: A56CBC40
md5: 7f81229e790b4c12d16da2ffe4b07795
name: 7F81229E790B4C12D16DA2FFE4B07795.mlw
sha1: cba701c6193791f22ff9d5dbd77f39f3f6831011
sha256: 79c1a4eeed768055e868cafc0ad2a87839f8a3a33a39c33d097d5d2e3af39959
sha512: 32a33be6d34831c9d8c656fc83c95d8b1a9d9a46b35f827901bb289251b5e313122faf20ee9915452696c4cdf2dd3f1ddce7e09609869b32d14b6432133cd305
ssdeep: 1536:PRVCaKgzbLc54hukfgvhnLtsWUpV1Ayj4m/QWR/Rlq88vlnRqPR/1aViDRknJM2s:ZjbLl/gvBLtxU31Tj4mYWR/R4nkPR/1N
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Win32:Agent-URR [Trj] also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKDZ.70799
CAT-QuickHealWorm.Sfone.A3
McAfeeArtemis!7F81229E790B
CylanceUnsafe
VIPREWorm.Win32.Agent.cp (v)
SangforMalware
CrowdStrikewin/malicious_confidence_100% (D)
BitDefenderTrojan.GenericKDZ.70799
K7GWTrojan ( 0051918e1 )
K7AntiVirusTrojan ( 0051918e1 )
InvinceaML/PE-A + Troj/Agent-BFWE
BaiduWin32.Worm.Agent.fj
CyrenW32/S-0f565bfc!Eldorado
SymantecW32.SillyWNSE
APEXMalicious
AvastWin32:Agent-URR [Trj]
ClamAVWin.Malware.D46e2dc-6911509-0
KasperskyTrojan.Win32.Wofith.ecx
NANO-AntivirusTrojan.Win32.Wofith.hzygna
RisingWorm.Agent!1.CEBD (CLASSIC)
Ad-AwareTrojan.GenericKDZ.70799
EmsisoftTrojan.GenericKDZ.70799 (B)
F-SecureTrojan.TR/Crypt.ULPM.Gen
DrWebTrojan.MulDrop15.57947
McAfee-GW-EditionBehavesLike.Win32.Generic.mc
FireEyeGeneric.mg.7f81229e790b4c12
SophosTroj/Agent-BFWE
IkarusWorm.Win32.Agent
JiangminWorm.Agent.tt
AviraTR/Crypt.ULPM.Gen
MAXmalware (ai score=88)
Antiy-AVLGrayWare/Win32.Agent.CP
MicrosoftWorm:Win32/Sfone
ArcabitTrojan.Generic.D1148F
ZoneAlarmTrojan.Win32.Wofith.ecx
GDataWin32.Worm.Sfone.B
CynetMalicious (score: 100)
AhnLab-V3Worm/Win32.Agent.R234001
Acronissuspicious
BitDefenderThetaAI:Packer.028521A51E
ALYacTrojan.GenericKDZ.70799
TACHYONWorm/W32.FakePorn.Zen
VBA32Worm.Agent
MalwarebytesWorm.Agent.666
ESET-NOD32Win32/Agent.CP
TencentMalware.Win32.Gencirc.10b07aee
YandexTrojan.GenAsa!yTn6LLlAQA4
SentinelOneStatic AI – Malicious PE
FortinetW32/Agent.CP!worm
AVGFileRepMalware
Cybereasonmalicious.e790b4
Qihoo-360HEUR/QVM18.1.540F.Malware.Gen

How to remove Win32:Agent-URR [Trj]?

Win32:Agent-URR [Trj] removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment