Rootkit.Win64.Agent.gud

RootkitWin64
Detection added: 02.11.2026 09:00:41 (GMT+2)
MD5: B3D2EE44B1906DB25EA572CB1D6DBC91
SHA1: 2D2CED069894F8EF114256AA746A1350DA9B0E29

Behavior: Rootkit

A rootkit is a collection of one or more tools designed to covertly maintain control of a computer. Initially rootkits appeared on UNIX operating systems (including Linux) and were a collection of tools which allowed an attacker to gain and keep access to the most privileged user on the computer (on UNIX systems this user is called ‘root’ — hence the name). On Windows based systems, rootkits have more commonly been associated with tools used for hiding programs or processes from the users. When installed, a Windows rootkit uses functions in the operating system to hide itself so as not to be detected, and is often used to hide other malicious programs such as keystroke loggers. The use of rootkits is not necessarily malicious, but they have come to be increasingly associated with undesirable behavior and malicious software.

Platform: Win64

This malware is in the Portable Executable (PE) format — a file format for executables, object code, DLLs and others used in 64-bit versions of Windows.

Systems affected: Windows XP (x64), Windows Vista (x64), Windows 7 (x64), Windows 8 (x64), Windows 10 (x64), Windows 11 (x64)

NOTE: The hash is only listed for the first detected malicious file. SHA/MD5 hash is not intended as a security/antivirus solution; it provides additional information that allows you to identify known malware files.

How to prevent infection

  • Use up-to-date antivirus software.
  • Install the latest updates for your operating system and installed software.
  • Use strong passwords and password management software.
  • Use caution when opening attachments, accepting file transfers and clicking on links to web pages.

Learn more