Categories: Malware

About “Midie.72972” infection

The Midie.72972 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Midie.72972 virus can do?

Executable code extraction
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Deletes its original binary from disk
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Creates a copy of itself
Anomalous binary characteristics

How to determine Midie.72972?


File Info:
crc32: F2AF0158md5: ed4d5006ade0bdc5e90225e84fe626d4name: mm.exesha1: 7b62974a4212320bac5a17800c4de88fbaabdab5sha256: 64454bd08efeb0224a59f83d232c0159ba7c89d36e9d63551c7d12f9a274c6e4sha512: 6383ce59636060325d5196c919b79e42cc61006393d913854a2ad271091e6789f08265fb6509cbccf9db714823691786b30c1c43048273b0a54018e6d12d87c6ssdeep: 3072:ogM09PAh7bUsVcGDA61vhv361vhvEX8eI:ogZ9PAh7wn0Aq3qHtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Microsoft Corp. All rights reserved.InternalName: SqlSetupBootstrapperFileVersion: 2009.0100.1600.01 ((KJ_RTM).100402-1540 )CompanyName: Microsoft CorporationGoldenBits: TrueLegalTrademarks: Microsoft SQL Server is a registered trademark of Microsoft Corporation.Comments: SQLProductName: Microsoft SQL ServerPlatform: NT INTEL X86ProductVersion: 10.50.1600.1FileDescription: Native SQL Install BootstrapperOriginalFilename: SqlSetupBootstrapper.exeTranslation: 0x0409 0x04b0

Midie.72972 also known as:

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Gen:Variant.Midie.72972
FireEye	Generic.mg.ed4d5006ade0bdc5
McAfee	GenericRXKU-MV!ED4D5006ADE0
ALYac	Gen:Variant.Midie.72972
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 005679eb1 )
BitDefender	Gen:Variant.Midie.72972
K7GW	Trojan ( 005679eb1 )
Cybereason	malicious.6ade0b
TrendMicro	TROJ_GEN.R002C0DG520
BitDefenderTheta	Gen:NN.ZexaF.34132.gq0@aSUOy6ij
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Redosdru.BM
TrendMicro-HouseCall	TROJ_GEN.R002C0DG520
Avast	Win32:Trojan-gen
GData	Gen:Variant.Midie.72972
Kaspersky	Backdoor.Win32.Lotok.cjn
Alibaba	Backdoor:Win32/Lotok.9c84bb93
NANO-Antivirus	Trojan.Win32.GenKryptik.hlfypt
Rising	Backdoor.Zegost!8.177 (TFE:dGZlOgXsm/wednIV/g)
Endgame	malicious (high confidence)
Sophos	Troj/AutoG-IA
F-Secure	Heuristic.HEUR/AGEN.1134990
DrWeb	Trojan.DownLoader33.47696
Zillya	Trojan.GenKryptik.Win32.49052
Invincea	heuristic
Emsisoft	Gen:Variant.Midie.72972 (B)
APEX	Malicious
Cyren	W32/Trojan.YJVK-7735
Jiangmin	Backdoor.Lotok.hx
Avira	HEUR/AGEN.1134990
Antiy-AVL	Trojan[Backdoor]/Win32.Lotok
Arcabit	Trojan.Midie.D11D0C
AhnLab-V3	Trojan/Win32.Kryptik.R339983
ZoneAlarm	Backdoor.Win32.Lotok.cjn
Microsoft	Backdoor:Win32/Zegost.BW
Cynet	Malicious (score: 85)
VBA32	BScope.Trojan.Dynamer
MAX	malware (ai score=82)
Ad-Aware	Gen:Variant.Midie.72972
Malwarebytes	Backdoor.Zegost
Ikarus	Trojan.Win32.Redosdru
Panda	Trj/GdSda.A
Tencent	Malware.Win32.Gencirc.10cdd188
SentinelOne	DFI – Suspicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/GenKryptik.EHYK!tr
AVG	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/Backdoor.f58