AIT:Trojan.Nymeria.4084 (file analysis)

The AIT:Trojan.Nymeria.4084 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AIT:Trojan.Nymeria.4084 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Attempts to modify proxy settings

How to determine AIT:Trojan.Nymeria.4084?

File Info:
name: F087E647E405A1EB1659.mlw
path: /opt/CAPEv2/storage/binaries/ddb8ee18f2801562fed78b914d4d063c68a93df91ed97633247f4efac68eaa1d
crc32: 36BBBB21
md5: f087e647e405a1eb165965e70be5a838
sha1: e31e910287d479ee2c0f31b65f9f4feb2758f3b9
sha256: ddb8ee18f2801562fed78b914d4d063c68a93df91ed97633247f4efac68eaa1d
sha512: 947e448ff0d593ba44b47352b3b85bf8b40fc7b8f74c550e35ed25c609055f5d1c6c4be05f20542bd03cf8ed59e86109880ef67b71e41c6b2ec1d2abbc01a14f
ssdeep: 6144:VuHIU3SCXOvfvt1FGo0pjx2EbeNsvEhr12rGuy27F9/:UoUiffvTYoUx2EbemMhp2rF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1891412BA63806C09E4560476C01BA9B51369FD272B52DB3F199CBE2B3F312F0DD255E8
sha3_384: e4ddc9bdd785b423acb1d81b5e0c0ff9138252608883b2aef7d14e4c49c254bd10526fe8b7be5088a2107bac131ba6d7
ep_bytes: 60be001045008dbe0000fbff5783cdff
timestamp: 2006-08-13 12:02:58

Version Info:
FileDescription: 
FileVersion: 3, 2, 0, 1
Translation: 0x0809 0x04b0

AIT:Trojan.Nymeria.4084 also known as:

How to remove AIT:Trojan.Nymeria.4084?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.