Doina.22126 (file analysis)

The Doina.22126 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.22126 virus can do?

Executable code extraction
Creates RWX memory
Expresses interest in specific running processes
Drops a binary and executes it
Uses Windows utilities for basic functionality
Attempts to repeatedly call a single API many times in order to delay analysis time
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Doina.22126?


File Info:
crc32: 5549F132
md5: 4be4f6c0bf62714b2c5abc88df15420a
name: 4BE4F6C0BF62714B2C5ABC88DF15420A.mlw
sha1: 4ce00a7fe25c5fe49597b876d52c808bb5b2470b
sha256: 00c67c8e506ff094c0a9f171a21a3598ad8b9abfdffaa2adeb1761857d884e16
sha512: 439fa59e009fc88f453b6da4f9a9a6c6a979235bbb5ebf6e4d07364278fdfbe0962d5bd70c9e6286dfe2b3a534a9ee060e4f1fbe2b8c97b24a09c246cd4f12ad
ssdeep: 98304:fs1dKGAujvn8ynYKw4f7U9FUJq99/BON3DKbMqEreYa:fsKGAujv1YKrq63DKbSKV
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
InternalName: UPDATE ZEPO
FileVersion: 1.00.0243
CompanyName: PB
ProductName: PB
ProductVersion: 1.00.0243
OriginalFilename: UPDATE ZEPO.exe

Doina.22126 also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.IgenericPMF.S22494482
ALYac	Gen:Variant.Doina.22126
Cylance	Unsafe
Cybereason	malicious.0bf627
Cyren	W32/Trojan.WCLG-8459
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GameHack.FJC potentially unsafe
APEX	Malicious
Avast	Win32:DropperX-gen [Drp]
ClamAV	Win.Malware.Zusy-9883587-0
Kaspersky	HEUR:HackTool.Win32.GameHack.gen
BitDefender	Gen:Variant.Doina.22126
MicroWorld-eScan	Gen:Variant.Doina.22126
Tencent	Malware.Win32.Gencirc.11d6fd5c
Ad-Aware	Gen:Variant.Doina.22126
Sophos	Generic ML PUA (PUA)
BitDefenderTheta	Gen:NN.ZexaF.34266.buW@aG9eFDfi
McAfee-GW-Edition	BehavesLike.Win32.PWSAxespec.rh
FireEye	Generic.mg.4be4f6c0bf62714b
Emsisoft	Gen:Variant.Doina.22126 (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.3464B4F
Microsoft	Trojan:Win32/Trickbot!ml
GData	Gen:Variant.Doina.22126
AhnLab-V3	Trojan/Win.Generic.R427509
McAfee	GenericRXAA-AA!4BE4F6C0BF62
MAX	malware (ai score=80)
Malwarebytes	Malware.AI.3350695336
Yandex	Riskware.Agent!vdKPnDS2FeI
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:DropperX-gen [Drp]

How to remove Doina.22126?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Doina.22126 (file analysis)