Agent.REK drops and executes other malware applications on the infected system, thus compromising system security.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
Knowledge Base
Find the latest advice in our Community Knowledge Base.
User Guide
See the user guide for your product on the Help Center.
Submit a sample
Submit a file or URL for further analysis.
Upon execution, Agent.REK drops and executes the following files:
Note: %System% represents a path that is typically C:\Windows\System32. Note: [Random Filename] represents a randomly generated filename used by the trojan at the time of infection, such as Oiv23.sys and Tqy10.sys. The dropped files are detected as Trojan-Downloader.Win32.Agent.GLH and Trojan-Dropper.Win32.Agent.REK respectively. This Trojan creates the following registry entries as part of its installation:
Trojan-Downloader.Win32.Agent.GLH then attempts to connect to the following IP addresses:
Files detected as Trojan-Dropper.Win32.Agent.slh have the same characteristics as Agent.REK.
Date Created: -
Date Last Modified: -