Malware

Johnnie.265796 information

Malware Removal

The Johnnie.265796 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Johnnie.265796 virus can do?

  • Executable code extraction
  • Presents an Authenticode digital signature
  • Possible date expiration check, exits too soon after checking local time
  • Creates RWX memory
  • A process created a hidden window
  • Drops a binary and executes it
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Executed a very long command line or script command which may be indicative of chained commands or obfuscation
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Attempts to execute a powershell command with suspicious parameter/s
  • Creates a hidden or system file
  • Anomalous binary characteristics

How to determine Johnnie.265796?


File Info:

crc32: 19396AE7
md5: 14f5c49fed363beef35e638f11bd9650
name: 14F5C49FED363BEEF35E638F11BD9650.mlw
sha1: 3617bb50419602b7af91ed5d5827352ed270353b
sha256: 92792d90db966fa2171238bea943030f20500d81c364df1888d8a1ee6afdcaec
sha512: 05075fa3adbdfb9e6014b5a4449443e51e0d663ee82a938e3c602f8bce4e8e4f09b18ba30b302120e49cfab95e5e406c1179f76edbdaf3454e906a5158650abe
ssdeep: 24576:uPV+0zD2lHV4a/G9x1UhjU+EwhrrngwmsemZEqda7FVASIy:MPGHV477/bornT9xZdd8aSIy
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Johnnie.265796 also known as:

K7AntiVirusTrojan ( 0056bb151 )
Elasticmalicious (high confidence)
DrWebTrojan.Rootkit.22087
CynetMalicious (score: 100)
McAfeeArtemis!14F5C49FED36
CylanceUnsafe
ZillyaTrojan.MaganiaCRTD.Win32.11362
SangforTrojan.Win32.Save.a
AlibabaTrojan:Win32/Kryptik.525b3f8b
K7GWTrojan ( 0056bb151 )
Cybereasonmalicious.fed363
SymantecHacktool.Rootkit
ESET-NOD32a variant of Win32/Kryptik.HBMG
APEXMalicious
AvastWin32:Trojan-gen
KasperskyUDS:Backdoor.Win32.Farfli.bswy
BitDefenderGen:Variant.Johnnie.265796
NANO-AntivirusTrojan.Win32.Kryptik.hpsxhv
MicroWorld-eScanGen:Variant.Johnnie.265796
TencentBackdoor.Win32.Gh0st.ab
Ad-AwareGen:Variant.Johnnie.265796
SophosMal/Generic-S
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionArtemis!Trojan
FireEyeGeneric.mg.14f5c49fed363bee
EmsisoftGen:Variant.Johnnie.265796 (B)
JiangminHeur:Backdoor/Huigezi
AviraTR/Crypt.Agent.hudte
MicrosoftPUA:Win32/Kuping
GDataGen:Variant.Johnnie.265796
AhnLab-V3Trojan/Win.Agent.C4531768
Acronissuspicious
VBA32BScope.Trojan.Rootkit
MAXmalware (ai score=81)
PandaTrj/GdSda.A
IkarusTrojan.Win32.Agent
FortinetW32/Kryptik.HBMG!tr
AVGWin32:Trojan-gen

How to remove Johnnie.265796?

Johnnie.265796 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment