Categories: Malware

Midie.104518 removal guide

The Midie.104518 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Midie.104518 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Attempts to connect to a dead IP:Port (1 unique times)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Latvian
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the DanaBot malware family

Related domains:

wpad.local-net

How to determine Midie.104518?


File Info:
name: 5367A0C4A30E5EB34734.mlwpath: /opt/CAPEv2/storage/binaries/04c3d9d645c254a617b44a8c9c6a7cf17db11b0f95e5080a3f2955539291e9c6crc32: 2B189CFDmd5: 5367a0c4a30e5eb34734bae03c3e2d1fsha1: 2936f7060b2019eac441756054ef02ae2a6dfa82sha256: 04c3d9d645c254a617b44a8c9c6a7cf17db11b0f95e5080a3f2955539291e9c6sha512: e8fec5efd9fcf5f96c98d5d4d30814fbe0be1649ac83f0b382f2937fd2f644ebdee5fbe7f2c98e7214c08e639790f8548a3a0139e60ec0353062823f7a3e1143ssdeep: 49152:mzWnPrIcO6eqYiwXOTXpiOz+++mcgr+J/y:2WnPrIsYitXcOzSHgmatype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1EA853324F7A548F1E0727A31AA74D01229B334B6E250839F3B55629E1EE17E16EF7343sha3_384: ae44a448e870e170db397c5f5ac139b81ad8651004549d24bc49bf5b1fcf5bdc8959c3b8b57c786bb2932a3e2aca8df0ep_bytes: e831340000e989feffffcccccccccccctimestamp: 2021-05-26 03:43:13
Version Info:
InternalName: bomgpiaruci.iwaCopyright: Copyrighz (C) 2021, fudkatProductVersion: 13.54.37.25Translation: 0x0117 0x046a

Midie.104518 also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Midie.104518
FireEye	Generic.mg.5367a0c4a30e5eb3
McAfee	Lockbit-FSWW!5367A0C4A30E
Malwarebytes	Trojan.MalPack.GS
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 00589d2d1 )
Alibaba	Ransom:Win32/StopCrypt.518133e3
K7GW	Trojan ( 00589d2d1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Midie.D19846
BitDefenderTheta	Gen:NN.ZexaF.34084.Rr0@aeayotgI
Cyren	W32/StopCrypt.B.gen!Eldorado
Symantec	Trojan Horse
ESET-NOD32	a variant of Win32/Kryptik.HNKB
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Midie.104518
Avast	Win32:PWSX-gen [Trj]
Tencent	Trojan-Spy.Win32.Stealer.16000121
Ad-Aware	Gen:Variant.Midie.104518
Sophos	Mal/Generic-R + Troj/Krypt-BO
Comodo	TrojWare.Win32.Agent.xtlby@0
Zillya	Trojan.Kryptik.Win32.3627318
TrendMicro	Ransom_StopCrypt.R002C0DKN21
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Emsisoft	Trojan.Crypt (A)
Ikarus	Trojan-Ransom.StopCrypt
eGambit	Unsafe.AI_Score_92%
Avira	TR/Crypt.Agent.amwml
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Generic.ASMalwS.34D6B81
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Ransom.Win32.STOP.sa
Microsoft	Ransom:Win32/StopCrypt.PU!MTB
ViRobot	Trojan.Win32.Z.Stopcrypt.1762816
GData	Win32.Trojan.BSE.11GYDBI
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.MalPE.R452306
Acronis	suspicious
VBA32	Malware-Cryptor.2LA.gen
ALYac	Gen:Variant.Midie.104518
Cylance	Unsafe
TrendMicro-HouseCall	Ransom_StopCrypt.R002C0DKN21
Rising	Trojan.Kryptik!1.DAC3 (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.PSE!tr
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/GdSda.A