Program:Win32/Ymacco.AAB8 (file analysis)

The Program:Win32/Ymacco.AAB8 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Program:Win32/Ymacco.AAB8 virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Program:Win32/Ymacco.AAB8?


File Info:
crc32: 0008DAA7
md5: 6dc4d8fa03d3e3bfee4c62b1c0e74bed
name: 6DC4D8FA03D3E3BFEE4C62B1C0E74BED.mlw
sha1: 10f96afb05e73b7a6eebb0282fa1c13ad04ed238
sha256: b8c23c5354abc5415e347170e750ead8d62da8ba8019b01b2cddb0a43208c7e7
sha512: 768dbd611526a243691ceaa8e9d4ab37aa7f98fb3af7a01318ec2c1016f052057da0c3d836f071f1dc11d26f11ea15e1930adbc7eddd74fac349c4fbf3dcad23
ssdeep: 6144:Cx+9DR9L2Y6fGKUjts0/UCLk3+gA5sE5uHd42:8kvIfnMs596S942
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2010
InternalName: Acala Software
FileVersion: 2, 0, 0, 1
CompanyName: Acala Software
ProductName: Acala Encoder Proxy
ProductVersion: 2.0.0.1
FileDescription: Acala Encoder Proxy
OriginalFilename: EncoderProxy.exe
Translation: 0x0409 0x04e4

Program:Win32/Ymacco.AAB8 also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.72328
FireEye	Generic.mg.6dc4d8fa03d3e3bf
ALYac	Trojan.GenericKDZ.72328
AegisLab	Trojan.Win32.Zusy.4!c
Sangfor	Malware
K7AntiVirus	Spyware ( 0040f0131 )
BitDefender	Trojan.GenericKDZ.72328
K7GW	Spyware ( 0040f0131 )
CrowdStrike	win/malicious_confidence_60% (D)
BitDefenderTheta	Gen:NN.ZedlaF.34700.xE8@aSehLblj
Cyren	W32/Dridex.BD.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	TrojanBanker:Win32/Kryptik.a5cbef4c
Tencent	Win32.Trojan-banker.Rtm.Wtea
Ad-Aware	Trojan.GenericKDZ.72328
Sophos	Mal/Generic-R + Mal/EncPk-APV
DrWeb	BackDoor.Qbot.575
TrendMicro	TROJ_GEN.R002C0RLV20
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKDZ.72328 (B)
Ikarus	Trojan.Win32.Crypt
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Program:Win32/Ymacco.AAB8
Gridinsoft	Trojan.Win32.Kryptik.oa
Arcabit	Trojan.Generic.D11A88
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKDZ.72328
Cynet	Malicious (score: 100)
McAfee	GenericRXNE-MQ!6DC4D8FA03D3
MAX	malware (ai score=89)
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Kryptik.HILY
TrendMicro-HouseCall	TROJ_GEN.R002C0RLV20
Rising	Malware.Obscure/Heur!1.A89E (CLASSIC)
Fortinet	W32/Dridex.TWY!tr
AVG	Win32:BankerX-gen [Trj]
Paloalto	generic.ml

How to remove Program:Win32/Ymacco.AAB8?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Program:Win32/Ymacco.AAB8 (file analysis)