Malware

Generic.Nymaim.E.E17EF6B6 removal instruction

Malware Removal

The Generic.Nymaim.E.E17EF6B6 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Generic.Nymaim.E.E17EF6B6 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Generic.Nymaim.E.E17EF6B6?


File Info:

name: 026CE439827DD7BF498E.mlw
path: /opt/CAPEv2/storage/binaries/a173ea3872857871e9d9b73f85d4dbaa834a0db673ab369fcf247ab54954423d
crc32: 564E3990
md5: 026ce439827dd7bf498edb643bc017f3
sha1: 6272182b4fee171709de88873f8240d0c245a166
sha256: a173ea3872857871e9d9b73f85d4dbaa834a0db673ab369fcf247ab54954423d
sha512: 9589df6bd28e3c300506f160c53983a25f18ee6a64baebe6f1daf6edb0eb9e3a45315092b8011200b62cb7c3343ee477bc97d4cd95035385ee4423c51a0833c7
ssdeep: 768:1bZ3lircyRvUR32SxRaSrkizgSIqUUzJYvkhpdU5FjV:193Ur5RWTDa7izbRUUzJYvkhpdCx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FD134B3C9EC206E2D777C9B79AF6F2C26911BE2130C74E8D598A37450C37A41B8A2C5D
sha3_384: 863110b74ec84bd7d28db6370e21efdaab1daed8a756a8923e241d25291d3d3c8d43b42c873f96301f9184102a81d92d
ep_bytes: 60be00d040008dbe0040ffff57eb0b90
timestamp: 2013-05-18 13:24:52

Version Info:

0: [No Data]

Generic.Nymaim.E.E17EF6B6 also known as:

BkavW32.AIDetectMalware
MicroWorld-eScanGeneric.Nymaim.E.E17EF6B6
SkyhighBehavesLike.Win32.Generic.ph
McAfeeGenericRXBB-SG!E4BC16D172AC
MalwarebytesCrypt.Trojan.Malicious.DDS
ZillyaDownloader.Waski.Win32.9691
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan-Downloader ( 004c603d1 )
K7GWTrojan-Downloader ( 004c603d1 )
Cybereasonmalicious.9827dd
SymantecDownloader.Upatre
Elasticmalicious (moderate confidence)
ESET-NOD32Win32/TrojanDownloader.Waski.N
APEXMalicious
TrendMicro-HouseCallTROJ_UPATRE.SM37
ClamAVWin.Malware.Upatre-6865076-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGeneric.Nymaim.E.E17EF6B6
NANO-AntivirusTrojan.Win32.Upatre.dsvtif
AvastWin32:Crypt-SHM [Trj]
TencentTrojan.Win32.Waski.na
EmsisoftGeneric.Nymaim.E.E17EF6B6 (B)
F-SecureTrojan.TR/Dropper.Gen
DrWebTrojan.Upatre.3514
VIPREGeneric.Nymaim.E.E17EF6B6
TrendMicroTROJ_UPATRE.SM37
Trapminemalicious.moderate.ml.score
FireEyeGeneric.mg.026ce439827dd7bf
SophosTroj/Upatre-OE
IkarusTrojan-Downloader.Win32.Waski
JiangminTrojan/Agent.ikis
GoogleDetected
AviraTR/Dropper.Gen
VaristW32/Waski.D.gen!Eldorado
Antiy-AVLTrojan[Downloader]/Win32.Waski
Kingsoftmalware.kb.b.995
MicrosoftTrojan:Win32/Wacatac.B!ml
XcitiumTrojWare.Win32.TrojanDownloader.Waski.NA@6jnofw
ArcabitGeneric.Nymaim.E.E17EF6B6
ViRobotTrojan.Win32.Upatre.57344.A[UPX]
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataWin32.Trojan-Downloader.Upatre.BK
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Upatre.R257285
Acronissuspicious
VBA32Trojan.Upatre
ALYacGeneric.Nymaim.E.E17EF6B6
MAXmalware (ai score=87)
Cylanceunsafe
RisingDownloader.Waski!1.A489 (CLASSIC)
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Upatre.Gen
FortinetW32/Generic.AC.3E5B91
BitDefenderThetaGen:NN.ZexaF.36802.cmHfai58Q5fi
AVGWin32:Crypt-SHM [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_90% (D)

How to remove Generic.Nymaim.E.E17EF6B6?

Generic.Nymaim.E.E17EF6B6 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment