Categories: Malware

Doina.57995 malicious file

The Doina.57995 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.57995 virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Creates a copy of itself
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Doina.57995?


File Info:
name: 786E9DDF7C72C8AAF6ED.mlwpath: /opt/CAPEv2/storage/binaries/e2bb12bd029c30f1a214eaabf4b265ad564927448e8864cc83c3be25f65fe9fdcrc32: 96F06111md5: 786e9ddf7c72c8aaf6ed8ac8b321c262sha1: 303b893002a553a16fa9a25bed86c01fd0bb1f96sha256: e2bb12bd029c30f1a214eaabf4b265ad564927448e8864cc83c3be25f65fe9fdsha512: fa0932dc2ef28d27be6e48164f94e00f1b213dad3ecf6f31cd8af5442a23cd5b67e64b577e6f3fa1c06a77965f1426f4f78e08026f62952e77c474eb456654d8ssdeep: 6144:5nxrhVEz5CHWhtk4w6ezxdMK8g3A7PFo4/3U4:5nxrhWz5CHWhtbwhMKX3AZbtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14F844A23D511E0F2D025067B76B9033D79B99732642681A7EBC4CF746EA63F18BA670Csha3_384: d72d12d6d47282a08329a696891b3e89a694cfb80d940bccbec3035ec359a40b2bea2df6fd7322573516aeac64765003ep_bytes: 558bec6aff68c081440068085f430064timestamp: 2023-02-28 04:29:47
Version Info:
FileVersion: 1.0.0.0FileDescription: 易语言程序ProductName: 易语言程序ProductVersion: 1.0.0.0LegalCopyright: 作者版权所有 请尊重并使用正版Comments: 本程序使用易语言编写(http://www.eyuyan.com)Translation: 0x0804 0x04b0

Doina.57995 also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Doina.57995
ClamAV	Win.Dropper.Tiggre-9845940-0
FireEye	Generic.mg.786e9ddf7c72c8aa
McAfee	RDN/Generic.dx
Malwarebytes	PUP.Optional.ChinAd
Zillya	Trojan.GenCBL.Win32.12405
Sangfor	Trojan.Win32.Save.BlackMoon
K7AntiVirus	Trojan ( 0058fc4f1 )
K7GW	Trojan ( 0058fc4f1 )
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/ABRisk.FKCW-3592
Symantec	Trojan Horse
ESET-NOD32	a variant of Win32/GenCBL.BUN
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Blamon.gen
BitDefender	Gen:Variant.Doina.57995
Avast	Win64:RATX-gen [Trj]
Tencent	Win32.Trojan.FalseSign.Osmw
F-Secure	Heuristic.HEUR/AGEN.1342531
DrWeb	Trojan.MulDrop21.53320
VIPRE	Gen:Variant.Doina.57995
TrendMicro	TROJ_GEN.R002C0PC323
McAfee-GW-Edition	RDN/Generic.dx
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Doina.57995 (B)
SentinelOne	Static AI – Suspicious PE
GData	Win32.Trojan-Stealer.BlackMoon.D
Avira	HEUR/AGEN.1342531
Antiy-AVL	Trojan/Win32.Blamon.a
Arcabit	Trojan.Doina.DE28B
ZoneAlarm	HEUR:Trojan.Win32.Blamon.gen
Microsoft	PUA:Win32/Fox
Google	Detected
AhnLab-V3	Malware/Win32.Generic.C2627103
ALYac	Gen:Variant.Doina.57995
MAX	malware (ai score=100)
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0PC323
Rising	Rootkit.Agent!1.E3AE (CLASSIC)
Ikarus	Trojan.Win32.Generic
MaxSecure	Dropper.Dinwod.frindll
Fortinet	Riskware/Blackmoon
AVG	Win64:RATX-gen [Trj]
Cybereason	malicious.f7c72c
DeepInstinct	MALICIOUS