Categories: Worm

About “Worm.Agent.FI” infection

The Worm.Agent.FI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm.Agent.FI virus can do?

Executable code extraction
Creates RWX memory
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Worm.Agent.FI?


File Info:
crc32: B573B4F7md5: 0b240e9ab662039aad8833f45ecc5d40name: 0B240E9AB662039AAD8833F45ECC5D40.mlwsha1: 950a074283eed6403946aa7831b8082acaef19desha256: 24e88618e19157c82d3aa503506f555734838227f886b8d3c0fcc1343ce2eb3csha512: 98a52cda18881db377a993cab9711e264fff86dca4407198c1f0aa45fc844111ee51f53d438d3a562f77e9cdd78d8bb9e3d27ea01997bb91068b0e76b938eb0assdeep: 3072:7aQo03tPdZeVXq8xNR6tgR07WtU/Wbf8HK/cd5eLKSD3+PZYyZtYMwm9Ipf:n0BXR0SUS87ILtD3/Euftype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright xa9 1996-2003 Macromedia, Inc.InternalName: Macromedia Flash Player 7.0FileVersion: 0.0.0.0 CompanyName: Macromedia, Inc.LegalTrademarks: Macromedia Flash PlayerProductName: Shockwave FlashProductVersion: 0.0.0.0 FileDescription: Macromedia Flash Player 7.0  r14OriginalFilename: SAFlashPlayer.exeTranslation: 0x0409 0x04b0

Worm.Agent.FI also known as:

Bkav	W32.Sality.PE
K7AntiVirus	Trojan ( 0053253c1 )
Lionic	Trojan.Win32.Generic.lyrh
Elastic	malicious (high confidence)
DrWeb	Win32.Sector.30
Cynet	Malicious (score: 100)
CAT-QuickHeal	W32.Sality.U
Cylance	Unsafe
Zillya	Virus.Sality.Win32.25
Sangfor	Virus_Suspicious.Win32.Sality.bh
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Virus:Win32/Sality.dc5af43b
K7GW	Trojan ( 0053253c1 )
Cybereason	malicious.ab6620
Baidu	Win32.Virus.Sality.gen
Cyren	W32/Sality.gen2
Symantec	Packed.Protexor!gen1
ESET-NOD32	Win32/Sality.NBA
Zoner	Trojan.Win32.Ramnit.32556
APEX	Malicious
Avast	Win32:SaliCode [Inf]
ClamAV	Win.Packed.Ramnit-9757109-0
Kaspersky	Virus.Win32.Sality.sil
BitDefender	Win32.Sality.3
NANO-Antivirus	Virus.Win32.Sality.beygb
ViRobot	Win32.Sality.Gen.A
MicroWorld-eScan	Win32.Sality.3
Tencent	Packed.Win32.Krap.f
Ad-Aware	Win32.Sality.3
Sophos	ML/PE-A + Mal/Sality-D
Comodo	Virus.Win32.Sality.gen@1egj5j
BitDefenderTheta	AI:FileInfector.A5ECCBAB0E
VIPRE	Virus.Win32.Sality.at (v)
TrendMicro	PE_SALITY.RL
McAfee-GW-Edition	BehavesLike.Win32.Sality.ch
FireEye	Generic.mg.0b240e9ab662039a
Emsisoft	Win32.Sality.3 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Win32/HLLP.Kuku.poly2
Webroot	W32.Sality
Avira	W32/Sality.AT
eGambit	Unsafe.AI_Score_52%
Antiy-AVL	Trojan/Generic.ASVirus.C4
Microsoft	Virus:Win32/Sality.AT
Arcabit	Win32.Sality.3
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
GData	Win32.Sality.3
TACHYON	Virus/W32.Sality.D
AhnLab-V3	Win32/Kashu.E
Acronis	suspicious
McAfee	W32/Sality.gen.z
MAX	malware (ai score=85)
VBA32	Virus.Win32.Sality.bakc
Malwarebytes	Worm.Agent.FI
Panda	Trj/Pck_Pretorx.A
TrendMicro-HouseCall	PE_SALITY.RL
Rising	Virus.Sality!1.A5BD (CLASSIC)
Yandex	Trojan.GenAsa!2ZJ/uITAWFA
Ikarus	Packed.Win32.Krap
MaxSecure	Virus.Sality.BH
Fortinet	W32/Zbot.CN!tr.pws
AVG	Win32:SaliCode [Inf]
Paloalto	generic.ml