Categories: Malware

Doina.16391 removal instruction

The Doina.16391 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.16391 virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Starts servers listening on 127.0.0.1:0
A process created a hidden window
Drops a binary and executes it
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Creates a hidden or system file
Detects VirtualBox through the presence of a registry key
Creates a copy of itself

Related domains:

note.youdao.com

ocsp.dcocsp.cn

How to determine Doina.16391?


File Info:
crc32: DE64C4A4md5: 1d030cb5b777a2a18d04014eca255efcname: 1D030CB5B777A2A18D04014ECA255EFC.mlwsha1: 7b691e0fab01b6114c0a76561f41d3ec1b0f904csha256: f6f871429d45d38af619a57956be48c8e6eb3a71e8e1097174dbfd342815d42esha512: 54b870d235ef7aa48eb832a68388241352f6e32e559b44eaf9a6f68ea19728cc3c755cd3c595da8ce635ec4b76426348fb919bb765b5b501b367cef572816c75ssdeep: 24576:u9s9VNjlLhcHgG9bIyD9PqN4jzKuXs1CAQx91j0I6484AuC:Gs9VNjlLhcHgUMynPUoFx91jj6545Ctype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: (C) 2019 Sogou.com Inc. All rights reserved.InternalName: Launcher.exeFileVersion: 3.3.0.30025CompanyName: x641cx72d7x9ad8x901fx6d4fx89c8x5668ProductName: x641cx72d7x9ad8x901fx6d4fx89c8x5668ProductVersion: 3.3.0.30025FileDescription: x641cx72d7x9ad8x901fx6d4fx89c8x5668 x4feex590dx7a0bx5e8fOriginalFilename: Launcher.exeTranslation: 0x0804 0x04b0

Doina.16391 also known as:

Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Doina.16391
Cylance	Unsafe
Sangfor	Riskware.Win32.Wacapew.C
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	TrojanDownloader:Win32/Lotok.f83d156e
Cybereason	malicious.fab01b
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.FSC
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	HEUR:Backdoor.Win32.Lotok.gen
BitDefender	Gen:Variant.Doina.16391
MicroWorld-eScan	Gen:Variant.Doina.16391
Ad-Aware	Gen:Variant.Doina.16391
Sophos	Generic PUA HL (PUA)
BitDefenderTheta	Gen:NN.ZexaF.34758.2u1@aaHrFmoj
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Artemis!Trojan
FireEye	Gen:Variant.Doina.16391
Emsisoft	Gen:Variant.Doina.16391 (B)
eGambit	PE.Heur.InvalidSig
Microsoft	Trojan:Win32/Wacatac.B!ml
AegisLab	Trojan.Win32.Doina.4!c
GData	Gen:Variant.Doina.16391
McAfee	GenericRXOW-ZQ!1D030CB5B777
MAX	malware (ai score=81)
VBA32	BScope.Backdoor.Lotok
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002H09FH21
Ikarus	PUA.OpenSUpdater
Fortinet	Riskware/Lotok
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml