Categories: Malware

Doina.17475 removal

The Doina.17475 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.17475 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Presents an Authenticode digital signature
Possible date expiration check, exits too soon after checking local time
Dynamic (imported) function loading detected
A process created a hidden window
Unconventionial language used in binary resources: Korean
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities for basic functionality
Deletes its original binary from disk

How to determine Doina.17475?


File Info:
name: 1BA52FD459AE5AF40304.mlwpath: /opt/CAPEv2/storage/binaries/aea2a3c9adef73dbc086c82fb64a8b991d5168e5643c0aaf2f669ee1377f6e1ccrc32: 9BC395E9md5: 1ba52fd459ae5af4030432d0a32402efsha1: 9d561702374873704afb4b2b905b1b0d785ac084sha256: aea2a3c9adef73dbc086c82fb64a8b991d5168e5643c0aaf2f669ee1377f6e1csha512: f383e4e6e952f00c0236ee3c51a3a531b04426e9e8349a502f7453758be84dce4f9736a357d52f409bdcbf14cd0f67ab28b013b7d10d865c52c4a4771021586essdeep: 12288:7UaYoU4WCQ36vziYXlah7l9pPdImBB7nSUNUnSb:coU4WCZGXb7BB7nBHbtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T155C47C213AD0E072D16231F14A5AD3747AF9A4305E36960B6BD40B7C6F349D29A2E37Fsha3_384: 8072e2fcca6b2f03d7694d7ab68c333d196a271ee7ec15f4c2eda9369cc22175623c48721cfb7c34e9a9c60580dc0824ep_bytes: e83cc20000e978feffff6a0c68d0a847timestamp: 2022-02-22 20:51:39
Version Info:
Comments: GalGa Operation.CompanyName: GalGa Company.FileDescription: GalGa SystemFileVersion: 1.0.0.1InternalName: GalGa..exeLegalCopyright: GalGa Company..  All rights reserved 2017.OriginalFilename: GalGa.exe.ProductName: GalGa System.ProductVersion: 1.0.0.1Translation: 0x0412 0x03b5

Doina.17475 also known as:

Lionic	Trojan.Multi.Generic.4!c
DrWeb	Trojan.MulDrop20.3421
MicroWorld-eScan	Gen:Variant.Doina.17475
FireEye	Gen:Variant.Doina.17475
ALYac	Gen:Variant.Doina.17475
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanDownloader:Win32/Generic.f69fdc34
K7GW	Trojan-Downloader ( 0058ec951 )
K7AntiVirus	Trojan-Downloader ( 0058ec951 )
Cyren	W32/Trojan.QRUC-7894
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.FXV
TrendMicro-HouseCall	TROJ_GEN.R03FH0CBQ22
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Doina.17475
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan-downloader.Agent.Eaxp
Ad-Aware	Gen:Variant.Doina.17475
Emsisoft	Gen:Variant.Doina.17475 (B)
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
GData	Gen:Variant.Doina.17475
Avira	TR/Dldr.Agent.bzine
MAX	malware (ai score=86)
Arcabit	Trojan.Doina.D4443
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Win.Generic.C4534483
McAfee	Artemis!1BA52FD459AE
VBA32	Trojan.Sabsik.TE
Malwarebytes	Trojan.Downloader
Rising	Downloader.Agent!8.B23 (CLOUD)
Ikarus	Trojan-Downloader.Win32.Agent
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W32/Agent.FXV!tr.dldr
AVG	Win32:Trojan-gen