Categories: Malware

IRC:Plea [Wrm] malicious file

The IRC:Plea [Wrm] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What IRC:Plea [Wrm] virus can do?

Drops a binary and executes it
Unconventionial language used in binary resources: Portuguese
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Detects the presence of Windows Defender AV emulator via files
Attempts to modify proxy settings
Creates a copy of itself
Harvests cookies for information gathering
Collects information to fingerprint the system
Uses suspicious command line tools or Windows utilities

How to determine IRC:Plea [Wrm]?


File Info:
name: 4E72B248E8D6DAC1F86C.mlwpath: /opt/CAPEv2/storage/binaries/5ccda65e9f9ffbef8b9abaf117b96856149384078382476e7ca981e4acfc502fcrc32: A0E48AEDmd5: 4e72b248e8d6dac1f86c7254c847abb9sha1: 4dd5218484a5fe7c13e0716f5476151e25e70a3csha256: 5ccda65e9f9ffbef8b9abaf117b96856149384078382476e7ca981e4acfc502fsha512: c4fd5cc8cb8782ba542392351c3f5d4350fb83d4e8f2b9efbb6115c00615df01f235b98957882026d42b90fa3a07acee38477714449de67d06d32c74662d200essdeep: 768:qq3G3q83wdv7GLGS1R9TNoINEx9jnhwrf:Jkq83wdv7GtVtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E6C2E183F69964B5E5B24170923F53683B16CD3247D787126A7E0D8FACA50302F1DDDAsha3_384: 6e7a94988db4b569d67c231dd001ff855713c35334baa31b2e53e70772c3cb202eb507c0c67649dc0771bf8d75c105c8ep_bytes: 60be00c040008dbe0050ffff5783cdfftimestamp: 2000-07-15 22:18:11
Version Info:
0: [No Data]

IRC:Plea [Wrm] also known as:

Bkav	W32.AIDetectMalware
Lionic	Worm.Win32.Plea.o!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Generic.Malware.SIM!hid!g.B174C9B8
FireEye	Generic.mg.4e72b248e8d6dac1
CAT-QuickHeal	W32.Plea.A4
ALYac	Generic.Malware.SIM!hid!g.B174C9B8
Malwarebytes	Generic.Malware.AI.DDS
Zillya	Worm.Plea.Win32.1
Sangfor	Worm.Win32.Plea.Vjqw
K7AntiVirus	EmailWorm ( 005a384a1 )
Alibaba	Worm:Win32/Scrambler.b6121155
K7GW	EmailWorm ( 005a384a1 )
Cybereason	malicious.8e8d6d
BitDefenderTheta	AI:Packer.116C49C620
VirIT	Worm.Win32.PLEA
Cyren	W32/HLLW.Plea.A
Symantec	W32.HLLP.Plea
ESET-NOD32	I-Worm.Plea.A
APEX	Malicious
ClamAV	Win.Trojan.Plea-2
Kaspersky	Email-Worm.Win32.Plea
BitDefender	Generic.Malware.SIM!hid!g.B174C9B8
NANO-Antivirus	Trojan.Win32.Plea.dbxesz
Avast	IRC:Plea [Wrm]
Tencent	Email-Worm.Win32.Plea.ha
Emsisoft	Generic.Malware.SIM!hid!g.B174C9B8 (B)
F-Secure	Heuristic.HEUR/AGEN.1333548
DrWeb	Win32.HLLW.Scrambler.26624
VIPRE	Generic.Malware.SIM!hid!g.B174C9B8
TrendMicro	PE_PLEA.A
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.mc
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-R
Ikarus	Email-Worm.Win32.Plea
GData	Generic.Malware.SIM!hid!g.B174C9B8
Jiangmin	I-Worm/Plea
Google	Detected
Avira	HEUR/AGEN.1333548
Xcitium	TrojWare.Win32.Trojan.XPACK.Gen@2ho5ur
Arcabit	Generic.Malware.SIM!hid!g.B174C9B8
ViRobot	I-Worm.Win32.A.Plea.129674
ZoneAlarm	Email-Worm.Win32.Plea
Microsoft	Worm:Win32/Plea.A
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Haxdoor.C2974
McAfee	W32/Scrambler.f@MM
MAX	malware (ai score=100)
VBA32	Worm.Plea
Cylance	unsafe
Panda	W32/Plea
TrendMicro-HouseCall	PE_PLEA.A
Rising	Worm.Mail.Plea (CLOUD)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.4880.susgen
Fortinet	W32/HLLW.Plea.A
AVG	IRC:Plea [Wrm]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (W)