Categories: Malware

About “Johnnie.29608” infection

The Johnnie.29608 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Johnnie.29608 virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Detects VMware through the presence of a registry key
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

ht.suzip.cn

a.tomx.xyz

How to determine Johnnie.29608?


File Info:
crc32: 8B32C1A3md5: e9b22ee8e38b7f9f9413589ab7774116name: yasuo_103.exesha1: 6047bb0e53ac4074a86b03a5d200e9211707ad0csha256: 68b76906022609f03019d2b04bdfc6720fffad22138f5720b0fa200651434ed6sha512: 63ff85de6fb04d158916ff7542e6abaace017f82a3ca394be8a34964414f8b6959ba355827f5c09b23b2192e58fafe49ae0879afd1e9abbd8720023f9836e4b5ssdeep: 98304:H4On+PoPpTLq0M0ww89V5v6jP9uApHS408R:YO8elLq90ww8kjcABj0Utype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: (C)Xun_Tux7248x6743x6240x6709ProductVersion: 1.0.0.1ProductName: ji_sux538bx7f29FileVersion: 1.0.0.1FileDescription: ji_sux538bx7f29Translation: 0x0804 0x03a8

Johnnie.29608 also known as:

MicroWorld-eScan	Gen:Variant.Johnnie.29608
CAT-QuickHeal	Pua.Sogou
McAfee	Artemis!E9B22EE8E38B
VIPRE	Adware.Sogou
K7GW	Trojan ( 005146801 )
K7AntiVirus	Trojan ( 005146801 )
Arcabit	Trojan.Johnnie.D73A8
TrendMicro	TROJ_GEN.R00AC0OJ917
Symantec	Trojan.Gen.2
TrendMicro-HouseCall	TROJ_GEN.R00AC0OJ917
Avast	Win32:Adware-gen [Adw]
GData	Gen:Variant.Johnnie.29608
Kaspersky	not-a-virus:AdWare.Win32.Sogou.qn
BitDefender	Gen:Variant.Johnnie.29608
Paloalto	generic.ml
Ad-Aware	Gen:Variant.Johnnie.29608
Emsisoft	Gen:Variant.Johnnie.29608 (B)
F-Secure	Gen:Variant.Johnnie.29608
DrWeb	Adware.ShouQu.5
Zillya	Adware.GenericKDCRTD.Win32.12133
McAfee-GW-Edition	Artemis!PUP
Sophos	Generic PUA GA (PUA)
Ikarus	PUA.NSISmod
Cyren	W32/Adware.MMKH-2199
Webroot	W32.Adware.Gen
Avira	ADWARE/Xpyn.sijbv
Antiy-AVL	GrayWare[AdWare]/Win32.PackedNsisMod.e
Endgame	malicious (high confidence)
ViRobot	Adware.Sogou.3321104
ZoneAlarm	not-a-virus:AdWare.Win32.Sogou.qn
AhnLab-V3	PUP/Win32.Installer.C2006866
ALYac	Gen:Variant.Johnnie.29608
AVware	Adware.Sogou
MAX	malware (ai score=100)
VBA32	AdWare.Sogou
ESET-NOD32	a variant of Win32/Packed.NSISmod.AL suspicious
eGambit	Unsafe.AI_Score_91%
Fortinet	Adware/Sogou
AVG	Win32:Adware-gen [Adw]
Cybereason	malicious.1b8fb7
Panda	Trj/CI.A
CrowdStrike	malicious_confidence_90% (D)