Categories: Malware

Mal/Generic-S + W32/MyDoom-N (file analysis)

The Mal/Generic-S + W32/MyDoom-N is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Mal/Generic-S + W32/MyDoom-N virus can do?

  • Attempts to connect to a dead IP:Port (11 unique times)
  • Starts servers listening on 0.0.0.0:1042
  • Reads data out of its own binary image
  • The executable is compressed using UPX
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Harvests information related to installed mail clients
  • Makes SMTP requests, possibly sending spam or exfiltrating data.
  • Creates a slightly modified copy of itself

Related domains:

ma1-aaemail-dr-lapp01.apple.com
ma1-aaemail-dr-lapp02.apple.com
ma1-aaemail-dr-lapp03.apple.com
rn-mailsvcp-ppex-lapp14.apple.com
rn-mailsvcp-ppex-lapp15.apple.com
rn-mailsvcp-ppex-lapp24.apple.com
rn-mailsvcp-ppex-lapp34.apple.com
rn-mailsvcp-ppex-lapp35.apple.com
mxa-00377f03.gslb.pphosted.com
rn-mailsvcp-ppex-lapp44.apple.com
rn-mailsvcp-ppex-lapp45.apple.com
mxb-00377f03.gslb.pphosted.com
apple.com
mxb-00377f01.gslb.pphosted.com
mx.cam.ac.uk
ismtp.sitestar.everyone.net
mx01.oxsus-vadesecure.net
pb-mx20.pobox.com
theriver.com
mx02.oxsus-vadesecure.net
pb-mx21.pobox.com
mx1-lw-eu.apache.org
onlineconnections.com.au
mx2-lw-eu.apache.org
mx2-lw-us.apache.org
mx1-lw-us.apache.org
openoffice.org
mx03.oxsus-vadesecure.net
pb-mx23.pobox.com
mx04.oxsus-vadesecure.net
pb-mx22.pobox.com
pb-mx14.pobox.com
netcom.com
pb-mx9.pobox.com
pb-mx10.pobox.com
pb-mx11.pobox.com
pobox.com
mx.pobox.com
mail.pobox.com
smtp.pobox.com
cl.cam.ac.uk
unicode.org
mx.cl.cam.ac.uk
mx.unicode.org
mail.cl.cam.ac.uk
mx.apple.com
mail.unicode.org
smtp.unicode.org
mail.apple.com
mx.theriver.com
smtp.apple.com
mail.theriver.com
smtp.theriver.com
mx.netcom.com
mail.netcom.com
smtp.netcom.com
smtp.cl.cam.ac.uk
mail.ietf.org
mx1.freebsd.org
pb-bounce4.pobox.com
ietf.org
mxg.dd.org
mx66.freebsd.org
park-mx.above.com
pb-bounce5.pobox.com
mx.zinfandel.lacita.com
mail.zinfandel.lacita.com
mx.ietf.org
freebsd.org
smtp.zinfandel.lacita.com
wellpartner-com.mail.protection.outlook.com
bounce2.pobox.com
dd.org
www.linux.org.uk

How to determine Mal/Generic-S + W32/MyDoom-N?


File Info:

crc32: CD4016AEmd5: 6e3eb7a689f74c1be3cc36e17b5b40b7name: 6E3EB7A689F74C1BE3CC36E17B5B40B7.mlwsha1: 368a7fa00deeaf424eb120e33584aa0e26c77467sha256: 2b7e797179a4c286386e147c85ad5dd117ec5279470588387cb68ee8252bfd87sha512: 1858bbb342aaca191ba2361339555f6bd5a7ae50da62afa0240f1c336c092eafae51d75521b0b0e09e13edeca4a87578058ed9afa7ea6356f25a62765c1a7c86ssdeep: 1536:n87wc1aGNC0klI7CPpIFa62p+g/1DrkoNrs/bZM1vxKf0:87wc1aOCo7CxIM+g/1Drko69Wx40type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Mal/Generic-S + W32/MyDoom-N also known as:

Bkav W32.MydoomU.Worm
K7AntiVirus Trojan ( 004bcce41 )
Elastic malicious (high confidence)
DrWeb Win32.HLLM.MyDoom.61471
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.IGENERICPMF.S15901808
ALYac Win32.Mydoom.L@mm
Cylance Unsafe
Zillya Worm.Mydoom.Win32.46
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_90% (D)
K7GW EmailWorm ( 0000439e1 )
Cybereason malicious.689f74
Baidu Win32.Worm-Email.Mydoom.a
Cyren W32/A-ea4fa60d!Eldorado
ESET-NOD32 Win32/Mydoom.Q
Zoner Worm.Win32.Mydoom.3368
APEX Malicious
Avast Win32:Mydoom-DS [Wrm]
ClamAV Win.Worm.Mydoom-7
Kaspersky Email-Worm.Win32.Mydoom.l
BitDefender Win32.Mydoom.L@mm
NANO-Antivirus Trojan.Win32.Mydoom.hevk
MicroWorld-eScan Win32.Mydoom.L@mm
Tencent Malware.Win32.Gencirc.10b70deb
Ad-Aware Win32.Mydoom.L@mm
Sophos Mal/Generic-S + W32/MyDoom-N
Comodo Worm.Win32.Mydoom.Q@3eht
BitDefenderTheta AI:Packer.DF7797571F
VIPRE Email-Worm.Win32.Mydoom.gen (v)
TrendMicro WORM_MYDOOM.GEN
McAfee-GW-Edition BehavesLike.Win32.Mydoom.lh
FireEye Generic.mg.6e3eb7a689f74c1b
Emsisoft Win32.Mydoom.L@mm (B)
SentinelOne Static AI – Malicious PE
Jiangmin I-Worm/Mydoom.l
Avira TR/BAS.Samca.kxxob
eGambit Unsafe.AI_Score_99%
Antiy-AVL Trojan/Generic.ASMalwS.1A628D
Kingsoft Win32.Troj.Generic_a.c.(kcloud)
Microsoft Trojan:Win32/Malex.gen!F
Gridinsoft Worm.Win32.Mydoom.ka!i
Arcabit Win32.Mydoom.EF57D8
GData Win32.Mydoom.L@mm
AhnLab-V3 Worm/Win32.MyDoom.R2057
Acronis suspicious
McAfee W32/Mydoom.c.n@MM
MAX malware (ai score=81)
VBA32 TrojanSpy.Agent
Malwarebytes Mydoom.Worm.DDoS.DDS
Panda W32/Mydoom.M.worm
TrendMicro-HouseCall WORM_MYDOOM.GEN
Rising Worm.Mydoom!1.A151 (CLASSIC)
Ikarus Email-Worm.Win32.Mydoom
MaxSecure Worm.W32.MyDoom.L
Fortinet W32/MyDoom.K!tr
AVG Win32:Mydoom-DS [Wrm]

How to remove Mal/Generic-S + W32/MyDoom-N?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Share
Published by
Paul Valéry

Recent Posts

MSIL/GenKryptik.GXIZ information

The MSIL/GenKryptik.GXIZ is considered dangerous by lots of security experts. When this infection is active,…

6 days ago

Malware.AI.2789448175 (file analysis)

The Malware.AI.2789448175 is considered dangerous by lots of security experts. When this infection is active,…

6 days ago

Jalapeno.1878 removal instruction

The Jalapeno.1878 is considered dangerous by lots of security experts. When this infection is active,…

6 days ago

What is “Trojan.Heur3.LPT.YmKfaKBcBekib”?

The Trojan.Heur3.LPT.YmKfaKBcBekib is considered dangerous by lots of security experts. When this infection is active,…

6 days ago

How to remove “Worm.Win32.Vobfus.exmt”?

The Worm.Win32.Vobfus.exmt is considered dangerous by lots of security experts. When this infection is active,…

6 days ago

About “TrojanDownloader:Win32/Beebone.JO” infection

The TrojanDownloader:Win32/Beebone.JO is considered dangerous by lots of security experts. When this infection is active,…

6 days ago