Worm

What is “Email-Worm.Win32.Warezov”?

Malware Removal

The Email-Worm.Win32.Warezov is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Email-Worm.Win32.Warezov virus can do?

  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (88 unique times)
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Attempts to identify installed AV products by registry key
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Generates some ICMP traffic
  • Makes SMTP requests, possibly sending spam or exfiltrating data.
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
mta6.am0.yahoodns.net
mta7.am0.yahoodns.net
mta5.am0.yahoodns.net
hotmail-com.olc.protection.outlook.com
www3.cedesunjerinkas.com
www4.cedesunjerinkas.com
mx.yandex.ru
mx00.mail.com
mx01.mail.com
mx13.bigmir.net
mx1.bigmir.net
mx3.bigmir.net
mx10.bigmir.net
mx12.bigmir.net
mx2.inbox.lv
mx1.inbox.lv
ma1-aaemail-dr-lapp01.apple.com
ma1-aaemail-dr-lapp02.apple.com
ma1-aaemail-dr-lapp03.apple.com
rn-mailsvcp-ppex-lapp14.apple.com
rn-mailsvcp-ppex-lapp15.apple.com
rn-mailsvcp-ppex-lapp24.apple.com
rn-mailsvcp-ppex-lapp34.apple.com
rn-mailsvcp-ppex-lapp35.apple.com
rn-mailsvcp-ppex-lapp44.apple.com
rn-mailsvcp-ppex-lapp45.apple.com
pb-mx21.pobox.com
pb-mx11.pobox.com
pb-mx23.pobox.com
pb-mx10.pobox.com
pb-mx20.pobox.com
pb-mx22.pobox.com
pb-mx14.pobox.com
pb-mx9.pobox.com
mx01.oxsus-vadesecure.net
mx02.oxsus-vadesecure.net
mx03.oxsus-vadesecure.net
mx04.oxsus-vadesecure.net
mxa-00377f01.gslb.pphosted.com
mx.cam.ac.uk
mxa-00377f03.gslb.pphosted.com
mxb-00377f03.gslb.pphosted.com
mxb-00377f01.gslb.pphosted.com
ismtp.sitestar.everyone.net
onlineconnections.com.au
mx2-lw-eu.apache.org
mx2-lw-us.apache.org
mx1-lw-us.apache.org
mx1-lw-eu.apache.org
msn-com.olc.protection.outlook.com
mx-aol.mail.gm0.yahoodns.net
mxa-0028be01.gslb.pphosted.com
mxb-0028be01.gslb.pphosted.com
aspmx2.googlemail.com
aspmx3.googlemail.com
mx1.mailchannels.net
mx2.mailchannels.net
oopp.pl
contoso-com.mail.protection.outlook.com
mail.fabrikam.com
mail.adatum.com
aspmx4.googlemail.com
aspmx5.googlemail.com
smtp.litwareinc.com
ma-02.vlada.hr
ma-01.vlada.hr
mail.vlada.hr
mail.dva.hr
antispam.hosting-zdarma.cz
cluster10.us.messagelabs.com
cluster10a.us.messagelabs.com
mail.h-email.net
mx.leonet.it
smtp2.leonet.it
dns2.leonet.it
ppp.ro
domini-cat.mail.protection.outlook.com
www2.cedesunjerinkas.com
mxbiz1.qq.com
mail.python.org
mxbiz2.qq.com
digicool.com
in2-smtp.messagingengine.com
in1-smtp.messagingengine.com
2mx.integra.net
wellpartner-com.mail.protection.outlook.com
park-mx.above.com
mail.ietf.org
mxg.dd.org
pb-bounce4.pobox.com
pb-bounce5.pobox.com
teconcept-de.mail.protection.outlook.com
mail.mailroute.net
mailfilter02.leaseweb.us
mailfilter01.leaseweb.us
mx3.mail.ovh.net
mx2.mail.ovh.net
mta.openssl.org
mx1.mail.ovh.net
mx15.blackberry.com
mx16.blackberry.com
hamlmail.niwa.co.nz
mx11.blackberry.com
wellmail.niwa.co.nz
mx12.blackberry.com
mx13.blackberry.com
mx14.blackberry.com
mx1.surfmailfilter.nl
mx2.surfmailfilter.nl
mx01.lightboundhosting.com
zeus.iit.demokritos.gr

How to determine Email-Worm.Win32.Warezov?


File Info:

crc32: 937BBD2B
md5: 3ebac8bd820cbbdc24e06cd9da4ea9d3
name: 3EBAC8BD820CBBDC24E06CD9DA4EA9D3.mlw
sha1: 9705d579a411869b0a429b8fc9ef7c7cd4f14d1a
sha256: a1a3e83f0137f527f5b86504cfb0cf0a5097a73a7d1caea41fbf5974d673b02c
sha512: e38c374b9a65f1fd2047a5f258ef1c40183566c2ce3bad27a616321f1f0a3e4973a8e71bf98ee8ec72b0c33938284c0364360010e8837de6eb965a60aa5c6eeb
ssdeep: 3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqoN:JjqVG/pJZzfwsGX+LOODg
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Email-Worm.Win32.Warezov also known as:

BkavW32.AIDetect.malware1
K7AntiVirusTrojan ( 00010be51 )
LionicWorm.Win32.Warezov.tpLU
Elasticmalicious (high confidence)
DrWebWin32.HLLM.Limar.based
CynetMalicious (score: 100)
CAT-QuickHealTrojan.Mauvaise.SL1
ALYacTrojan.GenericKD.30865232
CylanceUnsafe
ZillyaWorm.Stration.Win32.32
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
AlibabaWorm:Win32/Stration.c57b538e
K7GWTrojan ( 00010be51 )
Cybereasonmalicious.d820cb
CyrenW32/Warezov.YBCD-4106
SymantecW32.Stration!gen
ESET-NOD32Win32/Stration.DR
APEXMalicious
AvastWin32:Warezov-FL [Wrm]
ClamAVWin.Worm.Stration-7775246-0
KasperskyEmail-Worm.Win32.Warezov.gen
BitDefenderTrojan.GenericKD.30865232
NANO-AntivirusTrojan.Win32.Warezov.hjnhgd
MicroWorld-eScanTrojan.GenericKD.30865232
TencentWorm.Win32.Warezov.a
Ad-AwareTrojan.GenericKD.30865232
SophosMal/Generic-R + Troj/Agent-BAKM
ComodoWorm.Win32.Stration.DR@13yt
BitDefenderThetaAI:FileInfector.B7B4D1F315
VIPRETrojan.Win32.Generic!BT
TrendMicroMal_Strat-3
McAfee-GW-EditionBehavesLike.Win32.Generic.jz
FireEyeGeneric.mg.3ebac8bd820cbbdc
EmsisoftTrojan.GenericKD.30865232 (B)
SentinelOneStatic AI – Malicious PE
JiangminWorm.Warezov.avj
AviraWORM/Stration.C
eGambitUnsafe.AI_Score_99%
Antiy-AVLTrojan/Generic.ASMalwS.10875BB
KingsoftWin32.Troj.Generic_a.c.(kcloud)
MicrosoftWorm:Win32/Stration.M@mm
ArcabitTrojan.Generic.D1D6F750
ZoneAlarmEmail-Worm.Win32.Warezov.gen
GDataTrojan.GenericKD.30865232
AhnLab-V3Worm/Win32.Warezov.R227713
Acronissuspicious
McAfeeGenericRXFJ-CM!3EBAC8BD820C
MAXmalware (ai score=84)
VBA32Worm.Warezov
MalwarebytesWorm.Stration
PandaTrj/Genetic.gen
TrendMicro-HouseCallMal_Strat-3
RisingWorm.Stration!1.B560 (CLASSIC)
IkarusWin32.Warezov
MaxSecureWorm.Warezov.GEN
FortinetW32/Stration.46FD!tr
AVGWin32:Warezov-FL [Wrm]
Paloaltogeneric.ml

How to remove Email-Worm.Win32.Warezov?

Email-Worm.Win32.Warezov removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment