Nemesis.5930 (file analysis)

The Nemesis.5930 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Nemesis.5930 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location

How to determine Nemesis.5930?

File Info:
name: 366E0C668C53E0F3B878.mlw
path: /opt/CAPEv2/storage/binaries/613b4653001155160bbd5ee8f472a2827f281d37f0d7062e83f849c76f8bb4ee
crc32: E2E105E4
md5: 366e0c668c53e0f3b8783ee73c736159
sha1: 7ff020395521ad5a174ec6478340cbd3ac057d79
sha256: 613b4653001155160bbd5ee8f472a2827f281d37f0d7062e83f849c76f8bb4ee
sha512: 1519f39f8a688f4650342bdda0cd4ddacdc010b4273c71d23f297c578ed605c64718a324fb6f3f9fbdcaf934d26115a631ce174d77a8aac4dd9c0724669e000c
ssdeep: 12288:bNpIr3H1Fwz2KXE+7uAyZDSJSrF1v5/tLIoleHbRiMgiaM8Afu:bNpIr3H1Fwz2KXE+7uAyZDcSrF1v5/tB
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T137C44B288B26D4E5CC9F2D748C43A29F67922E50BA6D8253C53074E5FBFC366C7A6C11
sha3_384: 356bf1f8c3bdbe6566da724fb455ce3c19c72f40200df7a18c5acb7d2336922b96790129775abda6b262d71c87250b7c
ep_bytes: 558bec81ecf40300005356576a205f33
timestamp: 2021-09-25 21:55:49

Version Info:
Comments: Cinergy Corp.
CompanyName: Ceridian Corp.
FileDescription: Hovnanian Enterprises Inc.
FileVersion: 18.4.12
LegalCopyright: Ashland Inc.
LegalTrademarks: Enron Corp.
ProductName: InstallScript Setup Launcher
Translation: 0x0409 0x04b0

Nemesis.5930 also known as:

How to remove Nemesis.5930?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.