Jatif.3642 malicious file

The Jatif.3642 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Jatif.3642 virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Unconventionial language used in binary resources: Korean
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Jatif.3642?


File Info:
name: EB1DD2B4A56F517A1986.mlw
path: /opt/CAPEv2/storage/binaries/61a260054cbd6d69be087a57254e7f56d6963e90bfc4282d42d9410adcd0970f
crc32: 5D7D02FA
md5: eb1dd2b4a56f517a19866d062f8375ea
sha1: b524710897701bb4fb3a5701c25c61a5c2328c6e
sha256: 61a260054cbd6d69be087a57254e7f56d6963e90bfc4282d42d9410adcd0970f
sha512: 9b7f760cbd003e4311a2f5e2a63cd602ee51f88c2c0826679f04ff2ba0537c4c8d08074e8bcd42ddf9422b256c551ebf826605d7132f13c80401a7f4984ddf23
ssdeep: 24576:mv6PXin4ZrBrMtr3ja11+ikhFtRu/KRv1mjGVTeAJjsi:kdnEZC3a8F7u/UVqAZz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BC65E031BA92C073E9B20031AAADBB775838BC310735A1F7B3D42A5D5E741D169363A7
sha3_384: c93ab569f624f8815e0eb7989d03f02924eae155bbcfb1d521121e52e130dc54dae5e89d14405ce9ebf8ccae9a71d714
ep_bytes: e8838b0000e9000000006a1468806949
timestamp: 2022-08-29 04:44:55

Version Info:
CompanyName: MS-Compatibility
FileVersion: 1.0.0.2
InternalName: seckey-x64-sha256.exe
LegalCopyright: Copyright (C) 2021
ProductName: seckey-x64-sha256.exe
ProductVersion: 1.0.0.2
Translation: 0x0412 0x04b0

Jatif.3642 also known as:

MicroWorld-eScan	Gen:Variant.Jatif.3642
FireEye	Generic.mg.eb1dd2b4a56f517a
Malwarebytes	Malware.AI.4160983783
VIPRE	Gen:Variant.Jatif.3642
K7AntiVirus	Trojan ( 0056431d1 )
K7GW	Trojan ( 0056431d1 )
Cybereason	malicious.4a56f5
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/LockScreen.BSI
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Khalesi.gen
BitDefender	Gen:Variant.Jatif.3642
Avast	Win32:TrojanX-gen [Trj]
Ad-Aware	Gen:Variant.Jatif.3642
Zillya	Trojan.LockScreen.Win32.12573
Emsisoft	Trojan.LockScreen (A)
GData	Gen:Variant.Jatif.3642
Avira	HEUR/AGEN.1237928
Arcabit	Trojan.Jatif.DE3A
Microsoft	Ransom:Win32/LockScreen.LK!MTB
Google	Detected
ALYac	Gen:Variant.Jatif.3642
MAX	malware (ai score=80)
VBA32	BScope.Trojan.Khalesi
Rising	Trojan.LockScreen!8.1AF (TFE:5:OF6cLmj0m9C)
Ikarus	Trojan.Win32.LockScreen
AVG	Win32:TrojanX-gen [Trj]

How to remove Jatif.3642?

Jatif.3642 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X