Categories: Malware

What is “BAT/Delwin.NAI”?

The BAT/Delwin.NAI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What BAT/Delwin.NAI virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Anomalous file deletion behavior detected (10+)
Dynamic (imported) function loading detected
A process created a hidden window
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Detects the presence of Windows Defender AV emulator via files

How to determine BAT/Delwin.NAI?


File Info:
name: E1A581CE8D93875BD5C1.mlwpath: /opt/CAPEv2/storage/binaries/271499140cc37c89a0aa62181588dfb748b1f7ca1cd3ab8c8ee4301feb999657crc32: A4FCC16Bmd5: e1a581ce8d93875bd5c1c6db126816f3sha1: f9d9e9f16759ad1b7d80039ed2db0ad6fee83ed5sha256: 271499140cc37c89a0aa62181588dfb748b1f7ca1cd3ab8c8ee4301feb999657sha512: 09171473855fc6f373c84582c3b475ae70ef20b655c1012e6555c4910f614f38e72ed6713133d063003c20cba7a8b65ecfcc275f894d6fac8d325073bf695bcbssdeep: 3072:i2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcX/t:DbJhs7QW69hd1MMdxPe9N9uA0hu9TBGttype: PE32+ executable (GUI) x86-64, for MS Windowstlsh: T147C33966B2E01198DBB581F6D9921706EB7074361B15A3DB6BB853B31B2B4C68F3C3D0sha3_384: f8dd1822e2c9f1f826dd59d60261c006ff774af399b454865ca5d65b12bf254abe5b1ab0f00c0a45bdfd2e861371f335ep_bytes: 4883ec2849c7c0600100004831d248b9timestamp: 2018-02-01 19:43:24
Version Info:
0: [No Data]

BAT/Delwin.NAI also known as:

MicroWorld-eScan	Gen:Heur.Bat.1
FireEye	Generic.mg.e1a581ce8d93875b
McAfee	Artemis!E1A581CE8D93
Malwarebytes	Trojan.Agent
K7AntiVirus	Trojan ( 0058b9991 )
Alibaba	Trojan:BAT/Delwin.791051cd
K7GW	Trojan ( 0058b9991 )
Symantec	Trojan.Gen.MBT
ESET-NOD32	BAT/Delwin.NAI
APEX	Malicious
Paloalto	generic.ml
BitDefender	Gen:Heur.Bat.1
Ad-Aware	Gen:Heur.Bat.1
Emsisoft	Gen:Heur.Bat.1 (B)
McAfee-GW-Edition	BehavesLike.Win64.Generic.ch
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan.Win32.Tiggre
GData	Gen:Heur.Bat.1
Avira	TR/Bat.Delwin.wmsgb
Gridinsoft	Ransom.Win64.Sabsik.sa
Arcabit	Trojan.Bat.1
ViRobot	Trojan.Win32.Z.Bat.122368
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
ALYac	Gen:Heur.Bat.1
MAX	malware (ai score=81)
TrendMicro-HouseCall	TROJ_GEN.R002H09L821
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	BAT/Delwin.NAI!tr