Should I remove “AIT:Trojan.Nymeria.2478”?

The AIT:Trojan.Nymeria.2478 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AIT:Trojan.Nymeria.2478 virus can do?

• Sample contains Overlay data
• Reads data out of its own binary image
• Unconventionial binary language: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine AIT:Trojan.Nymeria.2478?

File Info:
name: AA7C7BD1DDBC6B68295C.mlw
path: /opt/CAPEv2/storage/binaries/5e61fafdace28689f34e464077d5dbe892e34487a665b5c746595997bfe6492c
crc32: DD34632F
md5: aa7c7bd1ddbc6b68295c313a60e5629c
sha1: 363fda05c25c3ae42946990a60a9bc0872600218
sha256: 5e61fafdace28689f34e464077d5dbe892e34487a665b5c746595997bfe6492c
sha512: dbb9c72df6fb0840d9184d03e77622785ec7c8904af23e9b09379acaf1be1cdbfdc1182a92e64db83aeb01e9117a522ade87f3cca989b146b37ad9335f2bac17
ssdeep: 6144:jlZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76wFcmrOuQzTY3Z:jHLUMuiv9RgfSjAzRt7mmShY3Z
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F1C47B86B501F73AC14FB2B03954D6BE95BD6F9CB8D0E50E20D13EAB31F956E9812C12
sha3_384: 69a3a0609b852b67a1399f5704df7a61ba54642c17c2ca6b24f205cedf4a8a9aee2173cf55fa1f507da04da21d242eeb
ep_bytes: 60be00004b008dbe0010f5ff5783cdff
timestamp: 2008-12-24 09:00:07

Version Info:
FileVersion: 3, 3, 0, 0
Comments: 在windows上快速搭建nginx、mysql、php网站服务器平台。
FileDescription: 
LegalCopyright: http://www.mangoscn.com
Translation: 0x0809 0x04b0
CompiledScript: AutoIt v3 Script : 3, 3, 0, 0

AIT:Trojan.Nymeria.2478 also known as:

How to remove AIT:Trojan.Nymeria.2478?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.