About “WinGo/Agent.BG” infection

The WinGo/Agent.BG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What WinGo/Agent.BG virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Collects information to fingerprint the system
• Suspicious wmic.exe use was detected

How to determine WinGo/Agent.BG?

File Info:
name: 238991A1583B8A907A61.mlw
path: /opt/CAPEv2/storage/binaries/4d6e7fe7d2d82e1e6b106482b8cf65fb11a4c89e5fff40f62efa3e9f71b767fb
crc32: 9E4DFCA6
md5: 238991a1583b8a907a61da63c403eef2
sha1: 55cb8b9c156d17f022202c91f9e9751d893bb0ed
sha256: 4d6e7fe7d2d82e1e6b106482b8cf65fb11a4c89e5fff40f62efa3e9f71b767fb
sha512: 105b7d1b51f0457bd13cd91b0bfa12d2ecb6f43d53a548671d78a435782de93e6ea6fd9e0a9e177ec3f65782003ccc963f73f912d533bffa4b7e697681ab5b83
ssdeep: 49152:t+nIQC1x3fmSLPVs1J5IA78vXj8j+N4X5U0iv/VkqyqtGr27S7IKlqAPsq2+z7Zh:t+ncX3rG78v1N4Iva1ll0tgs/i
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19F266B50F9EB44F9EA0B563044A7D23F6730A6198339CFC7CB442E97E8676D2193325A
sha3_384: 7dd0b406b6195fc7d37e3091882ead89a6f94b5fc41f214fcbe03e2b166fb8c21744a685b327449656fa544135ba5992
ep_bytes: e9fbd8ffffcccccccccccccccccccccc
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

WinGo/Agent.BG also known as:

How to remove WinGo/Agent.BG?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.