Categories: Malware

Doina.16617 (file analysis)

The Doina.16617 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.16617 virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
A HTTP/S link was seen in a script or command line
Authenticode signature is invalid
Uses Windows utilities for basic functionality
CAPE detected the MarkiRAT malware family
Uses suspicious command line tools or Windows utilities

How to determine Doina.16617?


File Info:
name: BCD7C5EA17E6092823C9.mlwpath: /opt/CAPEv2/storage/binaries/36de831fd352831a22d08a5bc54542e1f3f58b3c1ac8649c7d37fa21adb63bf7crc32: 7DAA4A61md5: bcd7c5ea17e6092823c9ecf3c90947a1sha1: 8fb773eafda49e77249b14d66f29924c98b35d63sha256: 36de831fd352831a22d08a5bc54542e1f3f58b3c1ac8649c7d37fa21adb63bf7sha512: 4a380d536c7c663da265d5532413aea3ddd5ba90d496964517776eedc7297d2b6495e733bac49aeb1e00fa931785757590afe31c833555b0f1655b83a14f38fessdeep: 98304:RGtKGyrpS6V2XcDOQZxsiFPkAhS0lUd35:RmKRsDXcOiFPkAhS0itype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T16B06BE703D00CCF2D52B82339AC9F679E2AF65700B6692CB5154BA4B2933E96DC1753Bsha3_384: aff500857e0d0286c80d86013b5ed6e1e57d7ce9e77f9e43d3e20fa1f2546038ecaabe753ed9d97138ccd5f0ab02d38bep_bytes: e8e70c0000e97afeffff3b0dc45f7500timestamp: 2018-11-25 11:17:01
Version Info:
CompanyName: MicrosoftFileDescription: Host ServiceFileVersion: 1.0.0.1InternalName: Service.exeLegalCopyright: Microsoft.  All rights reserved.OriginalFilename: mfcmklg.exeProductName: Host ServiceProductVersion: 1.0.0.1Translation: 0x0409 0x04b0

Doina.16617 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Doina.16617
FireEye	Generic.mg.bcd7c5ea17e60928
Zillya	Trojan.Agent.Win32.1967223
K7AntiVirus	Trojan ( 0057e0221 )
BitDefender	Gen:Variant.Doina.16617
K7GW	Trojan ( 0057e0221 )
Arcabit	Trojan.Doina.D40E9
ESET-NOD32	a variant of Win32/Agent.UTH
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Win32.Agentb.gen
Ad-Aware	Gen:Variant.Doina.16617
DrWeb	Trojan.MulDrop17.51519
VIPRE	Gen:Variant.Doina.16617
Emsisoft	Gen:Variant.Doina.16617 (B)
Jiangmin	Trojan.Agentb.jqd
Avira	TR/Agent.bccel
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Generic.ASMalwS.422
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Agentb.gen
GData	Gen:Variant.Doina.16617
Google	Detected
AhnLab-V3	Trojan/Win.Agent.R438936
ALYac	Gen:Variant.Doina.16617
Cylance	Unsafe
Panda	Trj/GdSda.A
Yandex	Trojan.Agentb!m+OB+MC4EKI
Ikarus	Trojan.Win32.Agent
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen