Categories: Malware

Behavior:Win32/DefenseEvasion.A!ml removal tips

The Behavior:Win32/DefenseEvasion.A!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Behavior:Win32/DefenseEvasion.A!ml virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Tries to unhook or modify Windows functions monitored by Cuckoo

How to determine Behavior:Win32/DefenseEvasion.A!ml?


File Info:
crc32: 9DD52AC9md5: a538a6f1b74f7a8e4b05ea143ef0eb23name: A538A6F1B74F7A8E4B05EA143EF0EB23.mlwsha1: fcf96b69d386e4e90a2963acf071a2c120a3833asha256: 3473d13400eb80a634dee0b582219fedf43874e217687a924955477937623750sha512: 2b297de11ac34a78f2d60d4d241507a89c0b2d8759cc8b4e297fd71b056b276f04f62753a706a64549064e667b4515c8d29158f187819730e0f9f104a14fee67ssdeep: 49152:+mKngauYdLc8IJizcmUJPhhpENzuiU0m/hC31P6YorygOUpjGSnKW951X02Quo9X:HKngauYdLc8IJizcmUlpENzuiU0m/hC7type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: x7528x6237x7aefFileVersion: 1.0.0.0CompanyName: x7528x6237x7aefComments: x7528x6237x7aefProductName: x7528x6237x7aefProductVersion: 1.0.0.0FileDescription:  x7528x6237x7aefTranslation: 0x0804 0x04b0

Behavior:Win32/DefenseEvasion.A!ml also known as:

Elastic	malicious (high confidence)
ClamAV	Win.Malware.Confidence-6629254-0
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_80% (W)
K7GW	Trojan ( 005246d51 )
K7AntiVirus	Trojan ( 005246d51 )
Cyren	W32/Agent.EW.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Cynet	Malicious (score: 100)
Sophos	Generic ML PUA (PUA)
Comodo	TrojWare.Win32.Agent.OSCF@5rs7jr
BitDefenderTheta	Gen:NN.ZexaF.34796.8r0@aOfi8gfH
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
FireEye	Generic.mg.a538a6f1b74f7a8e
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_100%
Antiy-AVL	Trojan/Generic.ASCommon.FA
Microsoft	Behavior:Win32/DefenseEvasion.A!ml
Acronis	suspicious
McAfee	Artemis!A538A6F1B74F
VBA32	BScope.Backdoor.BlackHole
Malwarebytes	Trojan.MalPack.FlyStudio
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/CoinMiner.65CA!tr
AVG	Win32:TrojanX-gen [Trj]
Qihoo-360	Win32/Trojan.Generic.HgIASYQA