Categories: Malware

Doina.19138 (file analysis)

The Doina.19138 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.19138 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Attempts to connect to a dead IP:Port (8 unique times)
Dynamic (imported) function loading detected
Network anomalies occured during the analysis.
Starts servers listening on 127.0.244.197:1389, 127.0.244.197:6188, 127.0.244.197:6288, 127.0.244.197:55998, 127.0.244.197:1358, 127.0.244.197:7501, 127.0.244.197:7502, 127.0.244.197:7503, 127.0.244.197:7504, 127.0.244.197:7505, 127.0.244.197:7506, 127.0.244.197:7507, 127.0.244.197:1312, 127.0.244.197:6181, 127.0.244.197:6281
Enumerates the modules from a process (may be used to locate base addresses in process injection)
Reads data out of its own binary image
Multiple direct IP connections
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Tries to suspend Cuckoo threads to prevent logging of malicious activity
Anomalous binary characteristics

Related domains:

config.yunjiasu.kkidc.com

httpbin.org

How to determine Doina.19138?


File Info:
name: B013996DB7E236693742.mlwpath: /opt/CAPEv2/storage/binaries/34527b0aa0c4094ed760126049cd92e37ac22a46b1f4ea4bbb468fa7a4436c17crc32: 61BD3B97md5: b013996db7e2366937424be0769bdee4sha1: 907078c490c828d2ff940a20b5e8ead6e2dbe24bsha256: 34527b0aa0c4094ed760126049cd92e37ac22a46b1f4ea4bbb468fa7a4436c17sha512: 4384a01be01a3092f750c794e0a0163479bd42cfddf76860bf0fe39b785c2f6dfd382d499083c7c4ec0abeb49e9b88e48245cb7d2f24a9143b19552adc00cd70ssdeep: 98304:DixHdV9K7wBtMKl9XdTmgc9UyplH53Tv46e8iwEz6I7Re2uIcGvY9zc:D6dgONTmgcGylv46ehdlRY9zctype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17A469E01E752C176F99314B65ABE976E287CAF311704A4C7E3C82E6D0A716E23A37353sha3_384: a00af7b042c0e8bebc8abc1b151c7afff2a2cea9bab56a2a61e6f6ac21b4bf61124f04d39305463aeed3f71a8c7613d1ep_bytes: e8e3ef0000e979feffff8bff558bec53timestamp: 2021-07-13 08:30:03
Version Info:
0: [No Data]

Doina.19138 also known as:

Lionic	Trojan.Win32.Bingoml.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Doina.19138
FireEye	Generic.mg.b013996db7e23669
McAfee	GenericRXPS-JL!B013996DB7E2
Cylance	Unsafe
Zillya	Trojan.Bingoml.Win32.5453
Sangfor	Trojan.Win32.Bingoml.gen
Alibaba	Trojan:Win32/Bingoml.253d3a4b
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Bingoml.gen
BitDefender	Gen:Variant.Doina.19138
Tencent	Malware.Win32.Gencirc.10cecaba
Ad-Aware	Gen:Variant.Doina.19138
Emsisoft	Gen:Variant.Doina.19138 (B)
TrendMicro	TROJ_GEN.R002C0PKM21
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Sophos	Mal/Generic-S
Paloalto	generic.ml
GData	Gen:Variant.Doina.19138
Jiangmin	TrojanDropper.Dapato.acwb
Avira	TR/Redcap.vzfzp
Antiy-AVL	Trojan/Generic.ASMalwS.34DE350
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Script/Phonzy.A!ml
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Generic.R457810
BitDefenderTheta	Gen:NN.ZexaF.34084.@BX@ayqSo0kj
ALYac	Gen:Variant.Doina.19138
MAX	malware (ai score=83)
VBA32	BScope.TrojanDropper.Dapato
TrendMicro-HouseCall	TROJ_GEN.R002C0PKM21
Yandex	Trojan.Bingoml!aORAKsskp78
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.109135027.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/CI.A