Should I remove “AIT:Trojan.Nymeria.2363”?

The AIT:Trojan.Nymeria.2363 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AIT:Trojan.Nymeria.2363 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Possible date expiration check, exits too soon after checking local time
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
• A potential decoy document was displayed to the user
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Anomalous binary characteristics

How to determine AIT:Trojan.Nymeria.2363?

File Info:
name: C5CEF266AD0A10043E5D.mlw
path: /opt/CAPEv2/storage/binaries/e11a5e4a2d4f9ce297f7f9d0bd907418448838ebacca0e662ed9eb46020c7e2b
crc32: 2F00D372
md5: c5cef266ad0a10043e5d6a058df71857
sha1: 44f1936489bb3f8f5a0a5968d8ca8d38a2dc2fec
sha256: e11a5e4a2d4f9ce297f7f9d0bd907418448838ebacca0e662ed9eb46020c7e2b
sha512: 9e96c0843651a0df26f8ac0b7699cefb59d11508956815bfaa3b648f4b073efe8a3ca98a55bbb68dcb9dfd6e01cee56fa4998e5aaf21577f297dc08aa79b3c73
ssdeep: 24576:lCdxte/80jYLT3U1jfsWaX4C6dIf777fCvxAdxDZCv48I3SwDngQpzQR:sw80cTsjkWaoC6dM7w4pZCQ8I3SyUR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DFA5C193F7C9C2D4CA2B11F3AE396E511E373C6A51757C692D883A2A1C731B2053BA53
sha3_384: 0bbab19e8a2d7d7c0e9cef04c10f4785230999590dec92c4ee4edcba78ac3cba64c0129e279619fffad9f29dbd5fd972
ep_bytes: e8b8d00000e97ffeffffcccccccccccc
timestamp: 2016-03-30 07:49:05

Version Info:
CompanyName: vXO OcXizPAcPxoPTMhWFiAH fLUloZabMscc
FileDescription: zLqEeNFcafwtHVKYGEIroSsg flehIbTpOPf
FileVersion: LdHqHYznfLNGJwQ
InternalName: oZPERHIcdBQrCtaCpOjvGIWWxVLfYl
LegalCopyright: oCLSErHPCopyright © 2007-2012 SzTfNYQEMrxgcqKMRfTV rrLQMNcIsxyyLEry 
LegalTrademarks: Copyright (C) 2008-2013 MskRklsJtMiZDyIfLCyNfKrTzICSTAltJWSrzsKE BGLVREIXzgYKNizyejY 
OriginalFilename: QJJLoGYpFcIucVCnTuJYyrbNSbcFptGxhzQVmvGvjC.exe
ProductName: istNvxmrVoCZjqEemUyUOVrCaVGzPeqHVsEemQWGpVcnIIgCinDXnTnwdcCukxemj
ProductVersion: 99.4
Translation: 0x0809 0x04b0

AIT:Trojan.Nymeria.2363 also known as:

How to remove AIT:Trojan.Nymeria.2363?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.