Trojan

Amadey.Trojan.Downloader.DDS removal

Malware Removal

The Amadey.Trojan.Downloader.DDS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Amadey.Trojan.Downloader.DDS virus can do?

  • Uses Windows utilities for basic functionality
  • HTTPS urls from behavior.
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Uses Windows utilities to create a scheduled task
  • Attempts to identify installed AV products by installation directory
  • Attempts to modify proxy settings
  • Appears to use command line obfuscation
  • Deletes executed files from disk
  • Uses suspicious command line tools or Windows utilities

How to determine Amadey.Trojan.Downloader.DDS?



File Info:

name: CBA31818C6AAF7B6B218.mlw
path: /opt/CAPEv2/storage/binaries/f487f7aefc49c35c486d4abd2c5163075369482aed443e41b73d2f4bb2af1938
crc32: C5254A37
md5: cba31818c6aaf7b6b21829d12c913269
sha1: 1c0ba49889ec6c7470329291d3344f36b8e07ae6
sha256: f487f7aefc49c35c486d4abd2c5163075369482aed443e41b73d2f4bb2af1938
sha512: 1387bec51c12165530ba77b35ad4b798053e41bd38182b6b8214ad53ea532190065f3a3afb1892b264513b55dc6dda1b681c223efeed9047960681d0b81df40b
ssdeep: 12288:sMrIy90jyME5zx7Un1zox0p+uibHHAAnXY5KK:8yFb921zoywlHHoD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T101C41282EAE88573D9B11B705CFF03A30F323CA18DB457972B56994E4C73A90A43176B
sha3_384: 6553718e6d2ee3078aea51414f83a198e4963b604731ab05e0aa8ec35caaf5a951ba68b43d90524194482bf7d1767f99
ep_bytes: e8f0060000e9000000006a5868b87240
timestamp: 2022-05-24 22:49:06


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
Translation: 0x0409 0x04b0

Amadey.Trojan.Downloader.DDS also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Agent.Y!c
DrWebTrojan.Siggen19.32857
MicroWorld-eScanTrojan.Generic.33923679
CAT-QuickHealTrojan.YakbeexMSIL.ZZ4
ALYacTrojan.Generic.33923679
MalwarebytesAmadey.Trojan.Downloader.DDS
VIPRETrojan.Generic.33923679
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005aad751 )
AlibabaTrojanDownloader:Win32/Stealer.0b3590ca
K7GWTrojan ( 005aad751 )
Cybereasonmalicious.889ec6
VirITTrojan.Win32.Genus.QXM
CyrenW32/Kryptik.JKR.gen!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32multiple detections
APEXMalicious
ClamAVWin.Packed.Lazy-9958163-0
KasperskyUDS:Trojan.MSIL.Agent.gen
BitDefenderTrojan.Generic.33923679
NANO-AntivirusTrojan.Win32.Disabler.jvlevr
AvastWin32:TrojanX-gen [Trj]
TencentWin32.Trojan.Deyma.Mcnw
EmsisoftTrojan.Generic.33923679 (B)
F-SecureTrojan.TR/ATRAPS.Gen
TrendMicroTrojanSpy.Win32.REDLINE.YXDFHZ
McAfee-GW-EditionBehavesLike.Win32.Generic.hc
Trapminemalicious.moderate.ml.score
FireEyeTrojan.Generic.33923679
SophosTroj/PlugX-EC
IkarusTrojan.Spy.Stealer
GDataWin32.Trojan-Downloader.Amadey.D
JiangminTrojanDownloader.Deyma.apn
AviraTR/AD.Nekark.sbcvr
MAXmalware (ai score=87)
Antiy-AVLTrojan[Downloader]/Win32.Amadey
ArcabitTrojan.Generic.D205A25F
SUPERAntiSpywareTrojan.Agent/Gen-Downloader
ZoneAlarmHEUR:Trojan.MSIL.Agent.gen
MicrosoftTrojan:Win32/plugx.psyC!MTB
GoogleDetected
Acronissuspicious
McAfeeArtemis!CBA31818C6AA
Cylanceunsafe
TrendMicro-HouseCallTrojanSpy.Win32.REDLINE.YXDFHZ
RisingDownloader.Deyma!8.1093B (TFE:5:UF2QdyMW7ZN)
SentinelOneStatic AI – Malicious SFX
FortinetMSIL/Disabler.DR!tr
AVGWin32:TrojanX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Amadey.Trojan.Downloader.DDS?

Amadey.Trojan.Downloader.DDS removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment