Midie.103383 removal guide

The Midie.103383 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Midie.103383 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• Enumerates running processes
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Latvian
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Writes a potential ransom message to disk
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Transacted Hollowing
• Created a process from a suspicious location
• Collects and encrypts information about the computer likely to send to C2 server
• Installs itself for autorun at Windows startup
• STOP ransomware registry artifacts detected
• Likely virus infection of existing system binary
• CAPE detected the STOP malware family
• Attempts to modify proxy settings
• Creates a copy of itself
• Creates a known STOP-Djvu ransomware decryption instruction / key file.
• Creates a known STOP ransomware variant mutex
• STOP ransomware command line behavior detected
• Uses suspicious command line tools or Windows utilities

How to determine Midie.103383?

File Info:
name: 3DB17D75AC17C1B7FAAC.mlw
path: /opt/CAPEv2/storage/binaries/d7e50ca295f57cf11497ce865d55f0d043db4c6b8d42694f853511e3104d3ce1
crc32: AB474FF0
md5: 3db17d75ac17c1b7faac5ca11fed2938
sha1: 2bc5c1146989542f7e90043f83ce225e00b258d7
sha256: d7e50ca295f57cf11497ce865d55f0d043db4c6b8d42694f853511e3104d3ce1
sha512: 37ac665c7e3b169e58c034e65fbc33c5a777308deb6342b26fe29759f99f1fe55e45bd194bc49abd2f1253776583a78276017e1ae2c501d25386a284bb743139
ssdeep: 12288:Tpw0F1Bm6/gr5HZpj30hjesrfqH2/nSPImEg8faTAtQgPN4YrO2g:qx64FjkhjwHrImEv3tQgPN4Yq2g
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CFF41201ABE6947EE1232D705D51B3712B7BBD226A30D50AF750673F0E732D04AA63DA
sha3_384: 23f39c39bdab478437f8acae528bbca6fba8bfb30ca050ce4b9e1ebc2d35f58cd4b48cabb0ba8a27f6eb4e011b4e262b
ep_bytes: e8b2380000e989feffff8bff558bec8b
timestamp: 2020-09-16 08:43:51

Version Info:
InternalName: bomgpiaruci.iwa
Copyright: Copyrighz (C) 2021, fudkagat
ProductVersion: 15.54.12.21
Translation: 0x0184 0x046a

Midie.103383 also known as:

How to remove Midie.103383?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.