What is “Doina.1112 (B)”?

The Doina.1112 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.1112 (B) virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• CAPE detected the CoinMiner02 malware family
• A cryptomining command was executed
• Attempts to disable Windows Defender
• Attempts to disable Windows Defender logging
• Attempts to remove Windows Defender from context menu
• Created a service that was not started
• Uses suspicious command line tools or Windows utilities

How to determine Doina.1112 (B)?

File Info:
name: 744E22F7C7E372EB16FF.mlw
path: /opt/CAPEv2/storage/binaries/6c336e319c931eb1ec9ed3948d92e65b7201973a7ce4ee55c64d4c48fef396c5
crc32: 098B601E
md5: 744e22f7c7e372eb16ff0886076b0600
sha1: 1cd72b250164b5b0333a6f69cace8c47dc8d44fc
sha256: 6c336e319c931eb1ec9ed3948d92e65b7201973a7ce4ee55c64d4c48fef396c5
sha512: ba813f5cc76820c7e5b577c5dabec24fc8822f8d4989904eb1d634b4778f84d51216fc7df2aa644fab8ce2ec88c1e226164bde94c22eeb14e60fd5d726cc78e3
ssdeep: 49152:VvkTSDvZ7r46p++3hqUZb6EVf13eQloVpQNwc27087vbrgKpAVgGHcWiqj9r3b60:pRjZ7rn/3xAEVf13eQCVVc2GKuGGHcWV
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B7E5331A168779BBD2F106B204E2610FA7B1FB501744DCDB939ABD2194222E3F57C1FA
sha3_384: abb77b3f45a891a34203e467b085340704084d1e9e6deebd371d255dbf9025f4d6bfd098973de242b4fea2f46ea89151
ep_bytes: 68ac00000068000000006810804100e8
timestamp: 2019-07-30 08:52:50

Version Info:
0: [No Data]

Doina.1112 (B) also known as:

How to remove Doina.1112 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.