What is “Nemesis.18173”?

The Nemesis.18173 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Nemesis.18173 virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Authenticode signature is invalid
Attempts to modify browser security settings

How to determine Nemesis.18173?


File Info:
name: CDB37CB2D0550AE0195A.mlw
path: /opt/CAPEv2/storage/binaries/cf97afd912cbe2d38331be43acbbb61dd6fe22c6f0ef012d9a8764b6a4d36045
crc32: D58EE458
md5: cdb37cb2d0550ae0195a7a04f948f7f2
sha1: 87f48f40d3d4e819d7d6a06a08ef7a888258d64d
sha256: cf97afd912cbe2d38331be43acbbb61dd6fe22c6f0ef012d9a8764b6a4d36045
sha512: 260f34c2f23f551ed66a1f59ac09eac7babbb0e5dd226aecf8330b9d181176e6a8b59fabe7a4c4ac51cedfceb69613a0ea83374036c7409309f9d7f50ce4170f
ssdeep: 768:1n04RNfdSXe28HjPxWlk0CoCzXtBi4PY//I0D3fmoxbxAuauIRdzOc1pq8Cpd0li:904f1SMHjZ0k/tB1g//I0DuoxbxAHscA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DE13AF1727A0D8F7C56207700E7BAB6AEFFAD20411A9070B97541F997D63AC34B1F292
sha3_384: 7d9ce4ba5e97da0839a0cb3db3c17c502bf48fe31e37404bfe4389dd217aec14e831bb28ad96a6305cee755a2a7e1cff
ep_bytes: 81ec8401000053565733db6801800000
timestamp: 2020-08-01 02:44:50

Version Info:
0: [No Data]

Nemesis.18173 also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Nemesis.18173
FireEye	Generic.mg.cdb37cb2d0550ae0
Skyhigh	BehavesLike.Win32.Dropper.ph
McAfee	Artemis!CDB37CB2D055
VIPRE	Gen:Variant.Nemesis.18173
BitDefender	Gen:Variant.Nemesis.18173
Cybereason	malicious.0d3d4e
Elastic	malicious (high confidence)
ESET-NOD32	NSIS/Adware.Runner.Q
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.RegRun.gen
F-Secure	Heuristic.HEUR/AGEN.1345559
Emsisoft	Gen:Variant.Nemesis.18173 (B)
Avira	HEUR/AGEN.1345559
MAX	malware (ai score=88)
Antiy-AVL	GrayWare[AdWare]/NSIS.Runner.q
Kingsoft	malware.kb.a.706
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Nemesis.D46FD
ZoneAlarm	HEUR:Trojan.Win32.RegRun.gen
GData	Gen:Variant.Nemesis.18173
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Nemesis.18173
DeepInstinct	MALICIOUS
AVG	FileRepMalware [Misc]
Avast	FileRepMalware [Misc]
CrowdStrike	win/grayware_confidence_60% (W)

How to remove Nemesis.18173?

Nemesis.18173 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X