Johnnie.255334 (file analysis)

The Johnnie.255334 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Johnnie.255334 virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time
Unusual version info supplied for binary

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Johnnie.255334?


File Info:
crc32: 3D427B83
md5: 93cae113d75d33f7124f7816bfdb8da0
name: 206a01938abgs.exe
sha1: 8e7cbd5f78b6c017d2a4853af433bbf965742c3f
sha256: 4adfd607d262412cc3b78df4c3393e697fd4699bcfa51fd0af208c1f4eae95d9
sha512: 74fade3d9b4c312ec2657db89e5b21409397210bdaea1d95e153f3d51b0355788764ac7687ae75c556a2fe0a6827859bdba5676a57c2d603992bb3dd33106a2a
ssdeep: 6144:gIWQeCCxoCa4EzEuP3K95X0H2kOU3vkjD8m3BZbyqP2X/:gIWQsoCaJr/Kjo8jD8EP2
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: BthCxn.exe
FileVersion: 6.0.6000.16384
CompanyName: Windows (R) Codename Longhorn DDK provider
ProductName: Windows (R) Codename Longhorn DDK driver
ProductVersion: 6.0.6000.16384
FileDescription: Bluetooth Connection Sample Application
OriginalFilename: BthCxn.exe
Translation: 0x0409 0x04b0

Johnnie.255334 also known as:

Bkav	W32.AIDetectVM.malwareB
MicroWorld-eScan	Gen:Variant.Zusy.306993
FireEye	Generic.mg.93cae113d75d33f7
ALYac	Gen:Variant.Johnnie.255334
Malwarebytes	Trojan.TrickBot
VIPRE	Win32.Malware!Drop
AegisLab	Trojan.Multi.Generic.4!c
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Gen:Variant.Zusy.306993
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.f78b6c
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/TrickBot.CR
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Rising	Malware.Undefined!8.C (CLOUD)
Ad-Aware	Gen:Variant.Zusy.306993
F-Secure	Trojan.TR/AD.TrickBot.pjhaw
DrWeb	Trojan.Packed.140
TrendMicro	Trojan.Win32.MIKEY.USXVPFI20
McAfee-GW-Edition	Artemis!Trojan
Trapmine	suspicious.low.ml.score
Emsisoft	Gen:Variant.Zusy.306993 (B)
SentinelOne	DFI – Malicious PE
Avira	TR/AD.TrickBot.pjhaw
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	Trojan:Win32/TrickBot.ARJ!MTB
Endgame	malicious (high confidence)
Arcabit	Trojan.Zusy.D4AF31
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Gen:Variant.Zusy.306993
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Trickbot.R340882
McAfee	GenericRXAA-AA!93CAE113D75D
Panda	Trj/CI.A
TrendMicro-HouseCall	Trojan.Win32.MIKEY.USXVPFI20
Tencent	Malware.Win32.Gencirc.119893b9
Ikarus	Win32.Outbreak
Fortinet	W32/Trickbot.HEEV!tr
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_80% (W)

How to remove Johnnie.255334?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Johnnie.255334 (file analysis)