Categories: Malware

Doina.8150 removal

The Doina.8150 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.8150 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Possible date expiration check, exits too soon after checking local time
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
HTTPS urls from behavior.
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Created a process from a suspicious location
Attempts to modify proxy settings
Harvests cookies for information gathering
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

rsys.topfreeweb.net

wpad.local-net

p.kf3msfm.com

How to determine Doina.8150?


File Info:
name: B1C438DA97580BC8E86B.mlwpath: /opt/CAPEv2/storage/binaries/036a98322b1854763aed3bcc499e262789a89faf37abb066f90305b3b1ddc10dcrc32: 1DD9BAF1md5: b1c438da97580bc8e86b2dc9f7007c17sha1: 4ae17e9741f4ab0706fe648d32f32d4f3793347dsha256: 036a98322b1854763aed3bcc499e262789a89faf37abb066f90305b3b1ddc10dsha512: 98c350e5ecd91ecdd0b19fafc90db24c7eca4b351bf45a411a34c870ac29a5c4a1d575b7caf74ba68a4698842e9ffe4ad40f6002a1bcadfeb901a47a35d802cassdeep: 6144:mkxRidttipXMk2/W3Ou6lik8bVeaaM8Veaav:7x4dttitMk2qJcJQe1MCe1vtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10A549E01B6D1C071E4B3067609F8AB65467DFE720B3198D773C82A5E6F31AD0AA3A753sha3_384: f9f197f293b3406a32bec25515e10a22736aa16094eb08fb7dbc85473514097fd910b525587ada707574ea933c5df75eep_bytes: e9f9500000cccccccc558bec51894dfctimestamp: 1993-12-08 09:24:36
Version Info:
0: [No Data]

Doina.8150 also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoad3.47169
MicroWorld-eScan	Gen:Variant.Doina.8150
FireEye	Generic.mg.b1c438da97580bc8
McAfee	Generic-FAGI!B1C438DA9758
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Birele.107f13f1
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	AI:Packer.D19998AB1F
Cyren	W32/Trojan.GLA.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.JVVSGIA
TrendMicro-HouseCall	TROJ_GEN.R03BC0PKO21
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Doina.8150
NANO-Antivirus	Trojan.Win32.DownLoad3.eykwda
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.10b55047
Ad-Aware	Gen:Variant.Doina.8150
Emsisoft	Gen:Variant.Doina.8150 (B)
Comodo	Application.Win32.AdWare.Wews87.K@85l5dt
TrendMicro	TROJ_GEN.R03BC0PKO21
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dh
Sophos	Mal/Generic-S
Ikarus	Trojan-Ransom.Birele
GData	Gen:Variant.Doina.8150
Jiangmin	TrojanDownloader.Agent.frmr
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.226F584
Gridinsoft	Ransom.Win32.Occamy.sa
Microsoft	Trojan:Win32/Occamy.C03
Cynet	Malicious (score: 100)
AhnLab-V3	PUP/Win32.MultiPlug.R214066
Acronis	suspicious
ALYac	Gen:Variant.Doina.8150
MAX	malware (ai score=99)
VBA32	BScope.Trojan.Agent
Malwarebytes	Malware.AI.4258876733
APEX	Malicious
Rising	Trojan.Generic@ML.100 (RDMK:Eo4PpOPTEZsH8yXNcFNm9g)
Yandex	Trojan.GenAsa!uGI4m1wHgEk
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_97%
Fortinet	W32/Generic.AP.1168D06!tr
AVG	Win32:Malware-gen
Cybereason	malicious.a97580
Panda	Trj/Genetic.gen