Malware

What is “Downloader.Win32.Gamini.bfn”?

Malware Removal

The Downloader.Win32.Gamini.bfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Downloader.Win32.Gamini.bfn virus can do?

  • Executable code extraction
  • Injection with CreateRemoteThread in a remote process
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (11 unique times)
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Uses Windows utilities for basic functionality
  • Code injection with CreateRemoteThread in a remote process
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Attempts to modify proxy settings
  • Attempts to create or modify system certificates

Related domains:

z.whorecord.xyz
a.tomx.xyz
reqbus.ru
apps.identrust.com
ssl.google-analytics.com
downloader.yandex.net
cache-mskm904.cdn.yandex.net
cache-mskm908.cdn.yandex.net
ocsp.comodoca.com
crl.usertrust.com
ocsp.globalsign.com
ocsp2.globalsign.com
crl.globalsign.com
clck.yandex.ru

How to determine Downloader.Win32.Gamini.bfn?


File Info:

crc32: 9F876A89
md5: 3620008dc063720d64ebf1d8dda4c228
name: hddregenerator.exe
sha1: 5617327538ad9df2d09778933aa4897fb5d44615
sha256: e42eae803ae2ff19e4bb97fcf02427a7c95a06c7bd8665ff8103627ec70950ce
sha512: 46f3fa8963ebae4135dbe8d16d205d543988e75e595745ce8bb035951877925f7882e44630f2a7c4346d3d6a008b0605e0e2d0c2b8228cc6b008ec2040641a18
ssdeep: 196608:EhsZNt15FmYyiEDGRLNgS1Szld5HgO95cmpkmVIXGu6CtxeVZqWmXuKLgh2Lgh8x:d1f2DGRyVsmpOWu6JmTXIhLhBh0BSBpY
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright:
FileVersion:
CompanyName:
Comments: This installation was built with Inno Setup.
ProductName: HDD Regenerator
ProductVersion:
FileDescription: HDD Regenerator Setup (r2006181719)
Translation: 0x0000 0x04b0

Downloader.Win32.Gamini.bfn also known as:

SymantecPUA.Gen.2
AvastWin32:Adware-gen [Adw]
Kasperskynot-a-virus:Downloader.Win32.Gamini.bfn
DrWebAdware.Downware.19806
IkarusTrojan-Downloader.Banload
Endgamemalicious (high confidence)
ZoneAlarmnot-a-virus:Downloader.Win32.Gamini.bfn
McAfeeArtemis!3620008DC063
TrendMicro-HouseCallTROJ_GEN.R002H0CG720
FortinetRiskware/Gamini
AVGWin32:Adware-gen [Adw]
Qihoo-360Win32/Virus.Downloader.7c5

How to remove Downloader.Win32.Gamini.bfn?

Downloader.Win32.Gamini.bfn removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment