How to remove “Doina.46172”?

The Doina.46172 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Doina.46172 virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Authenticode signature is invalid
CAPE detected the RedLine malware family

How to determine Doina.46172?


File Info:
name: C63E88335DD3371D06B9.mlw
path: /opt/CAPEv2/storage/binaries/8058bf50079ed089b9b1aa26021cef73262ce377508bc7a8390b6dd9ab5b398d
crc32: DE9F3CB6
md5: c63e88335dd3371d06b945ec3b9acfd7
sha1: 521ce7221ed95bcadc00364ca41d4499e8691dc2
sha256: 8058bf50079ed089b9b1aa26021cef73262ce377508bc7a8390b6dd9ab5b398d
sha512: d3edad6b91160c9ec8ce99a3aefb8dae6849e958c43fc154d8e24ce3eba4ffade3099d8f4790a55717582ef7cd3761aa84494e092e60c06806b6586b76a7f1af
ssdeep: 3072:BjITFOcwfUbLV13zBDVy3GHW57QyIArigdznBkcN4pwd9T0vOSZNe+xlMVqhqFJ6:9gwGBDkKsvJwaAOMk+xli87G29kP
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1CB54AE3A26D08076D873E0397FE693B7C32FA5327F999083179856260E395E255383DB
sha3_384: 38ba063e55d62803836e78b8375262266565aab7d14e51d1aaebc4a6fba9c0e1784142d162e290cf408ff6c7a5f3f549
ep_bytes: e8fa650000e9a4feffffcccccccccccc
timestamp: 2022-11-21 18:22:21

Version Info:
Comments: Imperturbably loafing abundance biographies
CompanyName: Conspiratorially
FileDescription: Shorts buffoons
FileVersion: 8.172.224.7
InternalName: Greaseproof untactful
LegalCopyright: Copyright © Scot huguenot viral winkled uneasy
LegalTrademarks: Intertwined predated ruralist dependencies imprison
OriginalFilename: Homogeneously fingernails
ProductName: Culled quietus
ProductVersion: 8.172.224.7
Translation: 0x081a 0x081a

Doina.46172 also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Doina.46172
Sangfor	Trojan.Win32.Save.a
ESET-NOD32	a variant of Win32/Kryptik.HRQA
APEX	Malicious
Kaspersky	UDS:Trojan-Spy.Win32.Stealer.gen
BitDefender	Gen:Variant.Doina.46172
Avast	Win32:PWSX-gen [Trj]
Emsisoft	Gen:Variant.Doina.46172 (B)
DrWeb	Trojan.PWS.StealerNET.125
Trapmine	suspicious.low.ml.score
Sophos	ML/PE-A
GData	Gen:Variant.Doina.46172
Google	Detected
Arcabit	Trojan.Doina.DB45C
ZoneAlarm	UDS:Trojan-Spy.Win32.Stealer.gen
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
AhnLab-V3	Trojan/Win.Injection.C5311647
Malwarebytes	Trojan.Crypt
Rising	Backdoor.Agent!8.C5D (TFE:5:9WMMZGOE28Q)
Ikarus	Trojan.Win32.Crypt
AVG	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Doina.46172?

Doina.46172 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X