Adware/Agent

description-logoAnalysis

Adware/Agent is classified as Adware.   Adware are software components that display unsolicited advertisements.
For additional information about Adware, and how Fortinet classifies Spyware threats please see Fortinet's paper in PDF format:
Spyware Classification and Terms.

  • Specifics for variant Agent.Y
    • It drops a file with an extension of .fld. It copies the filename of the original executable file. For example, if the original executable file is randomFile.exe, it drops the file named randomFile.fld. This .fld  file is a text file containing the path for the malicious copy of itself.
    • This malware chooses a path by looking for a random folder under the Program Files folder. It then copies a random filename from the chosen folder. Files that are chosen are usually those that have an extension than is not exe. It then drops a copy of itself to that directory using the copied filename with the exe extension name.

  • recommended-action-logoRecommended Action

      FortiGate Systems
    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the 'Allow Push Update' option.
      FortiClient Systems
    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Telemetry logoTelemetry

    Detection Availability

    FortiGate
    FortiClient
    FortiAPS
    FortiAPU
    FortiMail
    FortiSandbox
    FortiWeb
    Web Application Firewall
    FortiIsolator
    FortiDeceptor
    FortiEDR

    Version Updates

    Date Version Detail
    2024-03-18 92.02576
    2024-03-18 92.02572
    2024-03-18 92.02571
    2024-03-18 92.02570
    2024-03-18 92.02567
    2024-03-18 92.02564
    2024-03-18 92.02556
    2024-03-18 92.02553
    2024-03-17 92.02550
    2024-03-17 92.02547