Midie.63184 (file analysis)

The Midie.63184 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Midie.63184 virus can do?

Executable code extraction
At least one process apparently crashed during execution
Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Creates RWX memory
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Installs itself for autorun at Windows startup
Checks the CPU name from registry, possibly for anti-virtualization
Checks the system manufacturer, likely for anti-virtualization

Related domains:

d.nxxxn.ga

r.pengyou.com

How to determine Midie.63184?


File Info:
crc32: 9E695406
md5: be9b2709b164cf0920167682a98ae60f
name: BE9B2709B164CF0920167682A98AE60F.mlw
sha1: cef49d61b12ea15f3d274cdd95b1677f70766a06
sha256: d606f690cc82b3b366f244c81b26131c39c2725c356baeeae70429f3cf0b84ae
sha512: ea9d3e7ef9781400dd230a0388e008f9e2b121426dc9352242d6b41ebc50eddec08d72059eabcb1caf1bb94205f8db27c884d2317899a613335db092340bef1f
ssdeep: 6144:rv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:r4VOiF1WD7kE1dTYOi8V5u23zmWFy4
type: MS-DOS executable, MZ for MS-DOS

Version Info:
LegalCopyright: (C) 360.cn All Rights Reserved.
InternalName: LSPFix
FileVersion: 7, 1, 3, 1057
CompanyName: 360.cn
ProductName: 360x5b89x5168x536bx58eb
ProductVersion: 7, 1, 3, 1057
FileDescription: 360x5b89x5168x536bx58eb LSPx4feex590dx6a21x5757
OriginalFilename: LSPFix.EXE
Translation: 0x0804 0x04b0

Midie.63184 also known as:

MicroWorld-eScan	Gen:Variant.Midie.63184
CAT-QuickHeal	Trojan.Magania.18692
McAfee	GenericRXDW-XG!B141B1F565BB
Cylance	Unsafe
VIPRE	Backdoor.Win32.PcClient
BitDefender	Gen:Variant.Midie.63184
Cybereason	malicious.9b164c
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
GData	Gen:Variant.Midie.63184
Kaspersky	Trojan-Banker.Win32.Banbra.wrsh
Rising	Backdoor.Farfli!8.B4 (TFE:5:bL8vVvLdNzM)
Ad-Aware	Gen:Variant.Midie.63184
Comodo	TrojWare.Win32.Fusing.CF@5afr59
F-Secure	Heuristic.HEUR/AGEN.1042577
DrWeb	BackDoor.Farfli.96
Zillya	Trojan.Banbra.Win32.29854
Invincea	heuristic
McAfee-GW-Edition	GenericRXDW-XG!B141B1F565BB
FireEye	Generic.mg.be9b2709b164cf09
Emsisoft	Gen:Variant.Midie.63184 (B)
Ikarus	Trojan.Win32.Farfli
Jiangmin	Backdoor.Farfli.cmb
Avira	HEUR/AGEN.1042577
Endgame	malicious (high confidence)
Arcabit	Trojan.Midie.DF6D0
ZoneAlarm	Trojan-Banker.Win32.Banbra.wrsh
Microsoft	Backdoor:Win32/PcClient.ZR
AhnLab-V3	Malware/Win32.Generic.C2832100
Acronis	suspicious
ALYac	Gen:Variant.Midie.63184
MAX	malware (ai score=82)
VBA32	BScope.Trojan-GameThief.Magania
Zoner	Trojan.Win32.80229
ESET-NOD32	Win32/Farfli.BGG
Yandex	Packed/MPress
SentinelOne	DFI – Malicious PE
Fortinet	W32/Midie.26C0!tr
Webroot	W32.Trojan.Gen
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_80% (D)
Qihoo-360	HEUR/QVM18.1.FF5B.Malware.Gen

How to remove Midie.63184?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Midie.63184 (file analysis)