AIT:Trojan.Nymeria.5008 (file analysis)

The AIT:Trojan.Nymeria.5008 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AIT:Trojan.Nymeria.5008 virus can do?

• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Creates a copy of itself
• Anomalous binary characteristics

How to determine AIT:Trojan.Nymeria.5008?

File Info:
name: 34EDFEA9988B3836C4C4.mlw
path: /opt/CAPEv2/storage/binaries/53d323ec7cee8ee1bf21d21a271a16a7c3dbfe2aab49d416a53eac5230076f50
crc32: 26BB49C3
md5: 34edfea9988b3836c4c439d5681987bf
sha1: 0be1fba232422a1edfd0e7534a5a7f548d77a1d4
sha256: 53d323ec7cee8ee1bf21d21a271a16a7c3dbfe2aab49d416a53eac5230076f50
sha512: 2a58895959e4b26ba25cd536ee1674be3bd4d34473c386e0fc52a705469cb95258731d4b5b67aa785de9ca04367d364357357d7954b0f8ae7edf776a1fc90ea5
ssdeep: 49152:0JZoQrbTFZY1iaPbBaRB18lWAXU2PIJJv+NU3lbAX6loUI:0trbTA1xaRw/PPIDNAqloD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A5950221F5C69036C2B323719E7FF36A963D6A3A0327D19B27C81D315EA05816B39763
sha3_384: c29fdd3d7b90012ab6a120970a090d8d6bae3d61b9c56a4e7bf8be3291500039e04fdd4a7f71618d713b26e69c0cb31c
ep_bytes: e816900000e989feffffcccccccccc55
timestamp: 2012-01-29 21:32:28

Version Info:
FileDescription: 
FileVersion: 3, 3, 8, 1
CompiledScript: AutoIt v3 Script: 3, 3, 8, 1
Translation: 0x0809 0x04b0

AIT:Trojan.Nymeria.5008 also known as:

How to remove AIT:Trojan.Nymeria.5008?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.