Malware

Johnnie.330519 removal

Malware Removal

The Johnnie.330519 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Johnnie.330519 virus can do?

  • Executable code extraction
  • Compression (or decompression)
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Starts servers listening on 127.0.0.1:14656
  • Unconventionial language used in binary resources: Malay (Brunei Darussalam)
  • The binary likely contains encrypted or compressed data.
  • Deletes its original binary from disk
  • Steals private information from local Internet browsers
  • Collects information about installed applications
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Johnnie.330519?



File Info:

crc32: 5C04744B
md5: 257d60ea7950dc7088a7620f448fb32e
name: 257D60EA7950DC7088A7620F448FB32E.mlw
sha1: de781fe26daee2185706fd4f7d1d464871b966a0
sha256: c4475a8dbab92a8445599b092d4b5caa36a5473839a1ef85621d9cbdb570edbf
sha512: de7b6bf52f37de71a6d1b08dbeb6c24f4057ad6b52c227d33ae234caf9a629e5850adf80da3115a1c5d1872b57a6e56c72bd7e16ae36c520038bf9894fb3139b
ssdeep: 98304:34ZTNtsebe9yQ+xu0RdnzPS3yJ+z9drcxhbIGefL2XjMAp:3419PzPxg3cvIX8Mm
type: PE32 executable (GUI) Intel 80386, for MS Windows


Version Info:

ProductVersus: 1.9.37.29
FileVersion: 1.0.52.18
Translations: 0x0386 0x01d6

Johnnie.330519 also known as:

BkavW32.AIDetect.malware1
K7AntiVirusRiskware ( 0040eff71 )
Elasticmalicious (high confidence)
DrWebTrojan.Siggen13.17203
CynetMalicious (score: 99)
McAfeeArtemis!257D60EA7950
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_90% (W)
AlibabaTrojan:Win32/Glupteba.e862413a
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.26daee
CyrenW32/Kryptik.EAC.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HKSI
APEXMalicious
AvastWin32:PWSX-gen [Trj]
KasperskyHEUR:Trojan.Win32.Bsymem.gen
BitDefenderGen:Variant.Johnnie.330519
MicroWorld-eScanGen:Variant.Johnnie.330519
Ad-AwareGen:Variant.Johnnie.330519
SophosML/PE-A + Mal/GandCrypt-A
BitDefenderThetaGen:NN.ZexaF.34688.@x0@aKqT0noO
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_GEN.R002C0DE521
McAfee-GW-EditionBehavesLike.Win32.Lockbit.vc
FireEyeGeneric.mg.257d60ea7950dc70
EmsisoftGen:Variant.Johnnie.330519 (B)
SentinelOneStatic AI – Suspicious PE
AviraTR/Kryptik.qqnrn
MicrosoftTrojan:Win32/Glupteba.PW!MTB
ArcabitTrojan.Johnnie.D50B17
AegisLabTrojan.Win32.Bulz.4!c
ZoneAlarmHEUR:Trojan.Win32.Bsymem.gen
GDataGen:Variant.Johnnie.330519
AhnLab-V3Trojan/Win.MalPE.R419150
VBA32BScope.Backdoor.Convagent
MAXmalware (ai score=82)
MalwarebytesTrojan.MalPack.GS
PandaTrj/GdSda.A
TrendMicro-HouseCallTROJ_GEN.R002C0DE521
RisingTrojan.Glupteba!8.AA0 (CLOUD)
IkarusTrojan.Win32.Azorult
FortinetW32/Kryptik.HKSS!tr
AVGWin32:PWSX-gen [Trj]
Paloaltogeneric.ml

How to remove Johnnie.330519?

Johnnie.330519 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment