Downloader.10 (file analysis)

The Downloader.10 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Downloader.10 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)

How to determine Downloader.10?

File Info:
name: 4D6BE3F9113121231C82.mlw
path: /opt/CAPEv2/storage/binaries/e3db36f20b4942078de0dc4d4b3647e745e691e139f3f348d1e073868365cc85
crc32: 71E21D4C
md5: 4d6be3f9113121231c822f654a187088
sha1: 0bedee92c015fe82019afb6396df16dcb2e8c6ba
sha256: e3db36f20b4942078de0dc4d4b3647e745e691e139f3f348d1e073868365cc85
sha512: a44721dee4e719f20cba60ecd0d2d670697143378a64057f7d44c02c60e6aff508d32390add7564002b0a921f77562eae11af507c1cf24fbc44c00f51ca370c0
ssdeep: 384:3igfVpckTZg0Crq5JUaNJawcudoD7Up1fbSA3O:vfVpBT+0aqtnbcuyD7UplN3O
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13C628E51D2E45A5DD0E7413608BB6F0B1A54F80CDA9487DB14E8613F3DB3B60982E7E3
sha3_384: 615897f592557453f5e0a7c338c71c4cc321a85bd79c1aa79ca9953c2afbf223da7db0f4b9341ae1278549c2b26a4274
ep_bytes: 60be158040008dbeeb8fffff5789e58d
timestamp: 1970-01-01 00:00:00

Version Info:
Comments: http://www.metaquotes.net
CompanyName: MetaQuotes Software Corp.
FileDescription: MetaTrader
FileVersion: 4.0.0.402
InternalName: MetaTrader
LegalCopyright: © 2001-2011, MetaQuotes Software Corp.
LegalTrademarks: MetaTrader®
OriginalFilename: 
PrivateBuild: 
ProductName: MetaTrader
ProductVersion: 4.0.0.402
SpecialBuild: 
Translation: 0x0000 0x04b0

Downloader.10 also known as:

How to remove Downloader.10?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.