Categories: Malware

Doina.36529 removal instruction

The Doina.36529 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.36529 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Attempts to connect to a dead IP:Port (1 unique times)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Enumerates running processes
Authenticode signature is invalid
Attempts to repeatedly call a single API many times in order to delay analysis time
Steals private information from local Internet browsers
CAPE detected the Alfonoso malware family
Attempts to access Bitcoin/ALTCoin wallets
Harvests cookies for information gathering
Harvests credentials from local FTP client softwares
Collects information to fingerprint the system

How to determine Doina.36529?


File Info:
name: 184091B4BD9F02938F43.mlwpath: /opt/CAPEv2/storage/binaries/125c425b04053c5817557f7098dc8af428914c9f897c622f6958d80854e41cd8crc32: 434C6742md5: 184091b4bd9f02938f43e165acac2523sha1: 4dc08e51ea6c3ce1ebb2e55e59e8cd4546510d38sha256: 125c425b04053c5817557f7098dc8af428914c9f897c622f6958d80854e41cd8sha512: 843af3679dd02479235e8524dc31e6d35f2f2634c19d1c2bdb34d606fa5c317a9f3bf7b51c07f747e86984ce20136bbdb572b357254b9bb3d99a0bcb76e51b84ssdeep: 12288:QokfGiD8pdNn9KCT7tDlWCXJq7C7HbyyU9lbALDa/epZpiD:QoCDMNn9KCf1lWCXJWC7vU9lqPktype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T174C4BE0BE6429076E4632430229D8F6698BD7A3049236577B7C42D2D5EB01F2EB36F77sha3_384: f9d52bb8cc84cb33d002c8dbdf13705437ab7e170c597511702b27ee1af59cda8757772195f2050aebea946a5166899fep_bytes: e884040000e974feffff558bec81ec24timestamp: 2022-04-17 21:02:57
Version Info:
0: [No Data]

Doina.36529 also known as:

Lionic	Trojan.Win32.Shurk.i!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Doina.36529
FireEye	Generic.mg.184091b4bd9f0293
ALYac	Gen:Variant.Fragtor.29099
Malwarebytes	Generic.Trojan.Malicious.DDS
Sangfor	Trojan.Win32.Shurk.gen
K7AntiVirus	Password-Stealer ( 005724dd1 )
Alibaba	TrojanPSW:Win32/Phoenix.1025cb96
K7GW	Password-Stealer ( 005724dd1 )
BitDefenderTheta	Gen:NN.ZexaF.34606.IuW@a0WQw3hi
Cyren	W32/Agent.DJJ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/PSW.Agent.OKX
APEX	Malicious
ClamAV	Win.Malware.Zusy-9812688-0
Kaspersky	HEUR:Trojan-PSW.Win32.Shurk.gen
BitDefender	Gen:Variant.Doina.36529
Tencent	Malware.Win32.Gencirc.10d03d4d
Ad-Aware	Gen:Variant.Doina.36529
Sophos	Mal/Generic-S
TrendMicro	TROJ_GEN.R002C0DDO22
McAfee-GW-Edition	BehavesLike.Win32.Generic.hh
Emsisoft	Gen:Variant.Fragtor.29099 (B)
Avira	HEUR/AGEN.1213248
Antiy-AVL	Trojan/Generic.ASMalwS.3566F95
Kingsoft	Win32.PSWTroj.Undef.(kcloud)
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Phoenix.C5094321
Acronis	suspicious
VBA32	BScope.Trojan.Wacatac
MAX	malware (ai score=86)
TrendMicro-HouseCall	TROJ_GEN.R002C0DDO22
Rising	Stealer.Agent!8.C2 (CLOUD)
Yandex	Trojan.PWS.Agent!uLEZElhspcU
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Agent.OKX!tr.pws
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)