Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Malware
Threat report

Mint.Zard.5 removal

Published Feb 9, 2024 Malware category 3 min read
Report context

What to verify before removal

This report keeps Mint.Zard.5 removal in the active library because the detection has enough technical context to support a careful second-opinion scan and cleanup decision.

Start by comparing the local file name with 6D9883A897F560724DB6.mlw, then review the behavior notes for persistence entries, dropped files, unusual processes, and browser or network changes. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
6D9883A897F560724DB6.mlw
  • Compare the suspicious file name with 6D9883A897F560724DB6.mlw.
  • Confirm the detection name matches Mint.Zard.5 removal before removing related files.
  • Review the report for persistence entries, dropped files, unusual processes, and browser or network changes so the cleanup is based on observed behavior, not only the label.
  • Run a full scan, quarantine confirmed detections, and restart before signing back in to sensitive accounts.

The Mint.Zard.5 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Mint.Zard.5 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Mint.Zard.5?



File Info:

name: 6D9883A897F560724DB6.mlw
path: /opt/CAPEv2/storage/binaries/4f05867d487eb7a0875185b289a8382001215010025678ee57f925c694797d14
crc32: 087578C1
md5: 6d9883a897f560724db670cfc2a8d8a7
sha1: 11da08f6d87d7b9fbc36d9a21fce185b018f0603
sha256: 4f05867d487eb7a0875185b289a8382001215010025678ee57f925c694797d14
sha512: 4aa53588535a1ce8ec9ccca94d17e77d557e3fab0de84ae2b14d42a8af5dddf5825a21eeadc716825db7b6bffaa9e350fa0ff1fd6da747e9293f4840709edeb7
ssdeep: 24576:+UIg6mylJerK/bqTDtzgvyQLMSYZamjk9v++I:+qyrOTDpgTM3+I
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12905BF32A1614032FBF506B7B928A1303D7CD238175089AAD3E8AD5D7E74491ABFB357
sha3_384: 09fed4eb55ecbd3b7e9a17a0068ece5c047e9ac1f2a5976963207d1d01b735f4d00aafdbc1f99b878add590816562e41
ep_bytes: e839050000e97afeffffcccccccc8b44
timestamp: 2021-09-22 11:21:33


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Microsoft .NET SDK 7.0.401 (x64)
FileVersion: 7.4.123.42530
InternalName: setup
LegalCopyright: Copyright (c) Microsoft Corporation. All rights reserved.
OriginalFilename: dotnet-sdk-7.0.401-win-x64.exe
ProductName: Microsoft .NET SDK 7.0.401 (x64)
ProductVersion: 7.4.123.42530
Translation: 0x0409 0x04e4

Mint.Zard.5 also known as:

Bkav W32.AIDetectMalware
Lionic Virus.Win32.Senoval.n!c
Elastic malicious (high confidence)
Skyhigh BehavesLike.Win32.Sality.bc
ALYac Gen:Variant.Mint.Zard.5
VIPRE Gen:Variant.Mint.Zard.5
K7AntiVirus Trojan ( 005ad28b1 )
BitDefender Gen:Variant.Mint.Zard.5
K7GW Trojan ( 005ad28b1 )
Arcabit Trojan.Mint.Zard.5
BitDefenderTheta Gen:NN.ZexaF.36744.Xy0@aGR25Uni
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Patched.NKM
Cynet Malicious (score: 100)
Kaspersky Virus.Win32.Senoval.a
Alibaba Virus:Win32/Senoval.a8b4e678
NANO-Antivirus Virus.Win32.Gen-Crypt.ccnc
MicroWorld-eScan Gen:Variant.Mint.Zard.5
Rising Trojan.Generic@AI.80 (RDML:+AWYnEFBVyBBgom4N6LGxA)
Emsisoft Gen:Variant.Mint.Zard.5 (B)
F-Secure Trojan.TR/Patched.Gen
FireEye Generic.mg.6d9883a897f56072
Sophos Mal/Generic-S
Google Detected
Avira TR/Patched.Gen
MAX malware (ai score=86)
Antiy-AVL Trojan/Win32.Patched
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm Virus.Win32.Senoval.a
GData Gen:Variant.Mint.Zard.5
Varist W32/Patched.GQ1.gen!Eldorado
AhnLab-V3 Trojan/Win.Generic.C5487854
McAfee Artemis!6D9883A897F5
DeepInstinct MALICIOUS
VBA32 BScope.TrojanDownloader.Emotet
Cylance unsafe
Panda Trj/Genetic.gen
Tencent Trojan.Win32.Pathced_ya.16001052
Ikarus Trojan.Agent
MaxSecure Trojan.Malware.121218.susgen
Fortinet W32/Patched.IP!tr
AVG Win32:Patched-AWX [Trj]
Avast Win32:Patched-AWX [Trj]
CrowdStrike win/malicious_confidence_60% (D)

How to remove Mint.Zard.5?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.