Categories: Malware

Program:Win32/Ymacco.AA1A removal

The Program:Win32/Ymacco.AA1A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Program:Win32/Ymacco.AA1A virus can do?

Behavioural detection: Executable code extraction – unpacking
SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Program:Win32/Ymacco.AA1A?


File Info:
name: 5385FBEBEB37B41C065C.mlwpath: /opt/CAPEv2/storage/binaries/1a079c4200a284641bd1cb878143083e9b1f9f1da22201637d547f73e84c75a9crc32: 653359BFmd5: 5385fbebeb37b41c065cf61df7a26ac7sha1: e99b01e74e468b2ecbadc8e50cedb8b5683deedesha256: 1a079c4200a284641bd1cb878143083e9b1f9f1da22201637d547f73e84c75a9sha512: b231ce3aefe0667263effb8ef35fc1f4bff89812f3bccd8b5433135be8e5d69aa74ae9ea55f2b5eaa3e0b0866a779b9ddb8388db142ada4ee33ac5c7a121309assdeep: 768:jo6RfstFMXiyW2hT+955uaNQJ4TRuAGhMqo2yMAlLU5D:jo6hszMSJ2hTS/qG4TMqQMAuDtype: PE32 executable (console) Intel 80386, for MS Windowstlsh: T16403E185B18407B4C3A976300C57B9F3282680F59B165FE637E92DEE1CE78021E536E6sha3_384: 0c563a56c4397346e44b0b99dc482624dd89dd02c978d55683dc2dd9533312f3db4c34f27bdfc17644069c8b4be5fcfdep_bytes: b8548f41005064ff3500000000648925timestamp: 2010-08-16 15:29:27
Version Info:
0: [No Data]

Program:Win32/Ymacco.AA1A also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Generic.kZpz
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
McAfee	Artemis!5385FBEBEB37
Malwarebytes	Malware.AI.1718642036
Sangfor	Trojan.Win32.Toksteal.8
K7AntiVirus	Unwanted-Program ( 004a8e8a1 )
Alibaba	HackTool:Win32/Exploiter.e7175012
K7GW	Unwanted-Program ( 004a8e8a1 )
Cybereason	malicious.beb37b
VirIT	Backdoor.Win32.Hupigon5.CDMA
Cyren	W32/TokSteal.B.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Toksteal.C
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Trojan.6584806-1
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.Generic.7827976
NANO-Antivirus	Riskware.Win32.TrjGen.wdwct
MicroWorld-eScan	Trojan.Generic.7827976
Rising	Trojan.Occamy!8.F1CD (CLOUD)
Ad-Aware	Trojan.Generic.7827976
Emsisoft	Trojan.Generic.7827976 (B)
Comodo	Malware@#2kkgihjknhnu7
F-Secure	Heuristic.HEUR/AGEN.1216032
DrWeb	Win32.HLLW.Autoruner1.53009
Zillya	Tool.Exploiter.Win32.109
TrendMicro	HKTL_CVE20081436.SM
McAfee-GW-Edition	BehavesLike.Win32.Generic.nc
FireEye	Generic.mg.5385fbebeb37b41c
Sophos	Generic PUA OJ (PUA)
Ikarus	Trojan.Win32.Toksteal
GData	Trojan.Generic.7827976
Jiangmin	HackTool.Exploiter.m
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1216032
MAX	malware (ai score=85)
Kingsoft	Win32.HackTool.Exploiter.(kcloud)
Arcabit	Trojan.Generic.D777208
Microsoft	Program:Win32/Ymacco.AA1A
AhnLab-V3	Trojan/Win32.HackTool.R109923
ALYac	Trojan.Generic.7827976
Cylance	Unsafe
TrendMicro-HouseCall	HKTL_CVE20081436.SM
Tencent	Malware.Win32.Gencirc.10b3cc75
SentinelOne	Static AI – Malicious PE
Fortinet	W32/TOKSTEAL.C!tr
BitDefenderTheta	Gen:NN.ZexaF.34606.ciWfa00mngci
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)