Net-Worm.Win32.Kolab.aoqb information

The Net-Worm.Win32.Kolab.aoqb is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Net-Worm.Win32.Kolab.aoqb virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Steals private information from local Internet browsers
• Collects and encrypts information about the computer likely to send to C2 server
• Attempts to modify browser security settings
• Harvests credentials from local FTP client softwares
• Collects information to fingerprint the system
• Clears web history

How to determine Net-Worm.Win32.Kolab.aoqb?

File Info:
name: D41F902F606E92329EDF.mlw
path: /opt/CAPEv2/storage/binaries/997eb37a5c2b369874fd7101838313203d0994d5dd67f504b08887a2780c9d91
crc32: 4B5AC08F
md5: d41f902f606e92329edf269bcd02c794
sha1: 8da07dff5566b1d7e8c8ad438d1260df4f2cb0bd
sha256: 997eb37a5c2b369874fd7101838313203d0994d5dd67f504b08887a2780c9d91
sha512: ec6260be3c2490951598e0eb687757ce24714aff7ec8d84115884e0e9d0f01bde8f8be57f34af6ec6bb23edeaaaa704dc0fead6d98bb07513e6e59891bb07e8b
ssdeep: 6144:h9e3nK6rVpBwZsX7eA0dRfjOeFafRqh56ql11wihRoruV0:7G3rVCsreA0vSlfRG56qD1t4uV0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FD54126D7A11D7A2C0F3553BBA457D855D3FE1628B9E8333B288661C7C263EE3D0A850
sha3_384: 8e104d2764bfcd5319151e760a6a3e66c39633b55ca76bdf22b63f7ecfe6a7d4bc9c04ab4894d4fd26a05eb4c1f7ac88
ep_bytes: 90558bec83c4a48bd9f7db47e8760c00
timestamp: 2006-09-03 15:11:14

Version Info:
CompanyName: Xxfenccp Awjrbmlbqk
FileDescription: Xxfenccp Poshcctjan Kgknr
FileVersion: 41,36,98,105
InternalName: Xxfenccp
LegalCopyright: Copyright © Xxfenccp Awjrbmlbqk 2000-2008
OriginalFilename: Xxfenccp.exe
ProductName: Xxfenccp Poshcctjan Kgknr
ProductVersion: 84,39,117,7
Translation: 0x0409 0x04e4

Net-Worm.Win32.Kolab.aoqb also known as:

How to remove Net-Worm.Win32.Kolab.aoqb?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.