How to remove “Doina.18872”?

The Doina.18872 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Doina.18872 virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Authenticode signature is invalid

How to determine Doina.18872?


File Info:
name: DC7DD326AC74A0148306.mlw
path: /opt/CAPEv2/storage/binaries/634e5f4bfe657b7d36f22b0e976baf81f45af64001e329bdd84986af65ad76e1
crc32: 005DFA62
md5: dc7dd326ac74a014830601397ed45b72
sha1: 9850b66cd1d0e6b65bb52be53340a877d710fb1a
sha256: 634e5f4bfe657b7d36f22b0e976baf81f45af64001e329bdd84986af65ad76e1
sha512: d951879e33836598a760fff23fba7c6ecbaa716a61461b121ca293124eb3d65bd95e83790e19cd283ee626107f3edb7e06274a16c45ce63e843f493332e87e82
ssdeep: 1536:x9gJTbDkyt7u6SEfgIp8rQZRawxkczjQT/VfCfMOcA4ZfxVOHBn:x6JQ2u6Sip8cHVzMT/VfCfMO34ZxVOHF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19A932905A384819BF47C00B1A4A87B3BD637A9790B0F1563F3A89959A8752F96311FCF
sha3_384: ed211ae70dad6456b759dec7f3a64da8d90d26593e98150ba1644f019ec3af694a0283ec951ffe4226db139c6f4734ac
ep_bytes: 558bec6aff68c02e410068fc0f410064
timestamp: 2021-11-28 13:08:28

Version Info:
0: [No Data]

Doina.18872 also known as:

Bkav	W32.AIDetect.malware1
CAT-QuickHeal	Trojan.Generic.SK1
ALYac	Gen:Variant.Doina.18872
K7AntiVirus	Trojan ( 0040f8a31 )
BitDefender	Gen:Variant.Doina.18872
K7GW	Trojan ( 0040f8a31 )
Cybereason	malicious.6ac74a
ESET-NOD32	a variant of Win32/Farfli.CZM
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.Win32.Generic
MicroWorld-eScan	Gen:Variant.Doina.18872
Rising	Malware.Heuristic!ET#94% (RDMK:cmRtazqKae6y0AqqnTCiVTTaHgUf)
Ad-Aware	Gen:Variant.Doina.18872
Sophos	ML/PE-A
Comodo	TrojWare.Win32.Farfli.ANGL@5ruhi2
VIPRE	Trojan.Win32.Zegost.lt (v)
FireEye	Generic.mg.dc7dd326ac74a014
Emsisoft	Gen:Variant.Doina.18872 (B)
Ikarus	Trojan.Win32.KillAV
GData	Gen:Variant.Doina.18872
Jiangmin	Heur:Backdoor/Agent
Avira	HEUR/AGEN.1109810
MAX	malware (ai score=89)
Arcabit	Trojan.Doina.D49B8
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
VBA32	BScope.Trojan.Agent
Cylance	Unsafe
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Farfli.AJY!tr
BitDefenderTheta	Gen:NN.ZexaF.34294.fmW@aWiyBVk
CrowdStrike	win/malicious_confidence_80% (D)
MaxSecure	Trojan.Malware.300983.susgen

How to remove Doina.18872?

Doina.18872 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X