Categories: Malware

WinGo/Agent.CG (file analysis)

The WinGo/Agent.CG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What WinGo/Agent.CG virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Binary compilation timestomping detected

How to determine WinGo/Agent.CG?


File Info:
name: 12C1E458E1F813C4392F.mlwpath: /opt/CAPEv2/storage/binaries/e32e8ec188f444aca5b0b0f447f2c641fff34a4631b4c6243433467a9385434ecrc32: 3D93B782md5: 12c1e458e1f813c4392f397d089cf5casha1: f7dd1426ce746ad6951df82ddff40fbb7becf53fsha256: e32e8ec188f444aca5b0b0f447f2c641fff34a4631b4c6243433467a9385434esha512: 7aad171596c105da1ede43be0f6c3189536bbf288252680ea348c5ed74e6f9d771e79190dc73946f52d108750ad6c776fe3a5a9b6b99ced81945b283b9f5eba8ssdeep: 49152:uzTlbZMLRueuFTxQGTpQRnN9bQ8Al1LPpqB5EVuQHV9h0ycNGFHKa7JqC5GJxVM/:Elb1vLInNHADzc3EDVINwT7JzsxVJtype: PE32+ executable (GUI) x86-64, for MS Windowstlsh: T125E533C512FD016AE4F693B645FB534286317CA71AB4C0EF1AD5E16A1AB32D5CC32F22sha3_384: 446739f2f106eed745e81979c96c1e13e490a98bbbf28850b44da61b87f71b0a93326f78817663d0ffad36fd27a3430eep_bytes: 4883ec28e85b0700004883c428e90600timestamp: 2062-07-25 12:18:00
Version Info:
CompanyName: Microsoft CorporationFileDescription: Win32 Cabinet Self-Extractor                                           FileVersion: 11.00.19041.1165 (WinBuild.160101.0800)InternalName: Wextract                LegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: WEXTRACT.EXE            .MUIProductName: Internet ExplorerProductVersion: 11.00.19041.1165Translation: 0x0809 0x04b0

WinGo/Agent.CG also known as:

Cylance	Unsafe
K7AntiVirus	Trojan ( 00581f3e1 )
Alibaba	TrojanPSW:Win32/Stelega.b3fa1970
K7GW	Trojan ( 00581f3e1 )
CrowdStrike	win/malicious_confidence_60% (W)
ESET-NOD32	a variant of WinGo/Agent.CG
Kaspersky	Trojan-PSW.Win32.Stelega.faj
McAfee-GW-Edition	BehavesLike.Win64.Dropper.wc
FireEye	Generic.mg.12c1e458e1f813c4
GData	Win64.Trojan.Agent.OJW987
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
McAfee	Artemis!12C1E458E1F8
APEX	Malicious
Fortinet	W32/Agent.CG!tr
MaxSecure	Trojan.Malware.300983.susgen