Categories: Malware

Win64/PSW.Agent.BK malicious file

The Win64/PSW.Agent.BK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win64/PSW.Agent.BK virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Anomalous file deletion behavior detected (10+)
Dynamic (imported) function loading detected
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Queries information on disks, possibly for anti-virtualization
Steals private information from local Internet browsers
Harvests cookies for information gathering
Harvests credentials from local FTP client softwares

How to determine Win64/PSW.Agent.BK?


File Info:
name: A92A8CBE3D12911621B6.mlwpath: /opt/CAPEv2/storage/binaries/965968fa1c495776eb1276331ce2981f78e62074e1dba59100eff5679351b49ecrc32: F168DC38md5: a92a8cbe3d12911621b6f396d66f4643sha1: 0047a4f750af0442607676f6e75c3620756cfc35sha256: 965968fa1c495776eb1276331ce2981f78e62074e1dba59100eff5679351b49esha512: f34632d59b5b88b219ed6c3d48d9d1c022ed863f4e8420b0a3a313426e23c87ad426152a3cd5ea15cc6c92b2cdc924ad2ff0ada5c48286b7506aefd96cd0ad45ssdeep: 49152:TTkfzmLVQE+bVsiOKKG7nIjvMz7qBkebTxEcJH:HsyTK5mMCBkePtype: PE32+ executable (console) x86-64, for MS Windowstlsh: T16CB58D4BA7B900ECD167C17DC9065217EBB178151730ABDF56D08A6A2F63AF21E7E320sha3_384: fde78aea5a42b4bc643852fb9d8a0ab806c02f0191ef38ef1a47834aa8ed353541561311aaa0cc4748818f4638f2ca30ep_bytes: 4883ec28e8570500004883c428e972fetimestamp: 2021-12-09 19:56:45
Version Info:
0: [No Data]

Win64/PSW.Agent.BK also known as:

MicroWorld-eScan	Trojan.GenericKD.38316909
FireEye	Trojan.GenericKD.38316909
ALYac	Trojan.GenericKD.38316909
Zillya	Trojan.Agent.Win64.10539
Alibaba	TrojanPSW:Win64/DropperX.29ad75ca
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win64/PSW.Agent.BK
BitDefender	Trojan.GenericKD.38316909
Avast	Win64:DropperX-gen [Drp]
Ad-Aware	Trojan.GenericKD.38316909
Sophos	Generic PUA AA (PUA)
McAfee-GW-Edition	BehavesLike.Win64.CoinMiner.vh
Emsisoft	Trojan.GenericKD.38316909 (B)
Ikarus	Trojan-PSW.Agent
GData	Trojan.GenericKD.38316909
Gridinsoft	Ransom.Win64.Sabsik.sa
Arcabit	Trojan.Generic.D248AB6D
Microsoft	Program:Win32/Uwamson.A!ml
AhnLab-V3	Backdoor/Win.Mozaakai.R460894
McAfee	Artemis!A92A8CBE3D12
MAX	malware (ai score=89)
Malwarebytes	Malware.AI.4049365499
TrendMicro-HouseCall	TROJ_GEN.R002H0CLO21
Fortinet	W64/Agent.BK!tr.pws
AVG	Win64:DropperX-gen [Drp]