Malware

Program:Win32/Ymacco.AA81 malicious file

Malware Removal

The Program:Win32/Ymacco.AA81 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Program:Win32/Ymacco.AA81 virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • A process created a hidden window
  • Uses Windows utilities for basic functionality
  • Executed a process and injected code into it, probably while unpacking
  • Installs itself for autorun at Windows startup
  • Anomalous binary characteristics

How to determine Program:Win32/Ymacco.AA81?



File Info:

crc32: 7FBB5F38
md5: 211330e082c8bd70d248f9b1a77e1f27
name: 211330E082C8BD70D248F9B1A77E1F27.mlw
sha1: 622651218d7542db3238fc55ad5aa9e7b29f89ec
sha256: 8185e1807395501fac05c5f430841559e2852a1791e8b09c3d8b6198a2943407
sha512: 2c1bd0cb199833a3de2672c1893eb3cf78e1bf873bcfa7511070ab23449e24cb8d6bfcc3030af00d683dd1321eecdce60f7a36f9e3dbdfa2d4ce813b21acd119
ssdeep: 6144:kvb+9DR9L2Y6fGKUjts0/UCLk3+gA5sE5uHdTavy:8kvIfnMs596S9Tavy
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows


Version Info:

LegalCopyright: Copyright xa9 2016
InternalName: Java Control Panel
FileVersion: 11.121.2.13
Full Version: 11.121.2.13
CompanyName: Oracle Corporation
ProductName: Java(TM) Platform SE 8 U121
ProductVersion: 8.0.1210.13
FileDescription: Java Control Panel
OriginalFilename: javacpl.exe
Translation: 0x0409 0x04b0

Program:Win32/Ymacco.AA81 also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.35941493
FireEyeGeneric.mg.211330e082c8bd70
ALYacTrojan.GenericKD.35941493
CylanceUnsafe
SangforMalware
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.GenericKD.35941493
K7GWRiskware ( 0040eff71 )
CrowdStrikewin/malicious_confidence_70% (D)
BitDefenderThetaGen:NN.ZedlaF.34700.ww8@a8uvgpli
CyrenW32/Trojan.XOEK-3400
SymantecML.Attribute.HighConfidence
APEXMalicious
Paloaltogeneric.ml
KasperskyTrojan-Banker.Win32.RTM.hvx
AlibabaTrojanBanker:Win32/Kryptik.eab0cc05
AegisLabHacktool.Win32.Krap.lKMc
RisingMalware.Obscure/Heur!1.A89E (CLASSIC)
Ad-AwareTrojan.GenericKD.35941493
EmsisoftTrojan.GenericKD.35941493 (B)
F-SecureTrojan.TR/Crypt.Agent.jrxok
DrWebTrojan.Inject4.6403
TrendMicroTROJ_GEN.R002C0RLV20
McAfee-GW-EditionArtemis!Trojan
SophosMal/Generic-R + Mal/EncPk-APV
JiangminTrojan.Banker.RTM.vh
AviraTR/Crypt.Agent.jrxok
MAXmalware (ai score=81)
Antiy-AVLGrayWare/Win32.Kryptik.ehls
MicrosoftProgram:Win32/Ymacco.AA81
GridinsoftTrojan.Win32.Downloader.oa
ArcabitTrojan.Generic.D2246C75
ZoneAlarmTrojan-Banker.Win32.RTM.hvx
GDataTrojan.GenericKD.35941493
CynetMalicious (score: 100)
McAfeeGenericRXNE-LU!211330E082C8
VBA32BScope.Trojan.Diple
PandaTrj/Genetic.gen
ESET-NOD32a variant of Win32/Kryptik.HILY
TrendMicro-HouseCallTROJ_GEN.R002C0RLV20
TencentWin32.Trojan-banker.Rtm.Hmrb
IkarusTrojan.Win32.Crypt
FortinetW32/Kryptik.HIDC!tr
AVGWin32:BankerX-gen [Trj]
AvastWin32:BankerX-gen [Trj]

How to remove Program:Win32/Ymacco.AA81?

Program:Win32/Ymacco.AA81 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment