Program:Win32/Ymacco.AAEB malicious file

The Program:Win32/Ymacco.AAEB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Program:Win32/Ymacco.AAEB virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Program:Win32/Ymacco.AAEB?


File Info:
crc32: CBD44059
md5: 897096a23897a2a09572e0b9946c9f78
name: 897096A23897A2A09572E0B9946C9F78.mlw
sha1: b458a16b8a3764e3767713d7a795920f657463e9
sha256: eba445b553f980d95dd64c36e2029a02b59284c8fd26d6f688279a2b13c2f8c3
sha512: 29bc0a27abff5bd3dd4c5e7a860a1b42ab23b98f40aabd7e511131067034fdbe4a1854b5cae3aab2b39f530d377ae62346f30f347875a96891a8515cd6a4d411
ssdeep: 6144:bU+9DR9L2Y6fGKUjts0/UCLk3+gA5sE5uHdM2:YkvIfnMs596S9M2
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2010
InternalName: Acala Software
FileVersion: 2, 0, 0, 1
CompanyName: Acala Software
ProductName: Acala Encoder Proxy
ProductVersion: 2.0.0.1
FileDescription: Acala Encoder Proxy
OriginalFilename: EncoderProxy.exe
Translation: 0x0409 0x04e4

Program:Win32/Ymacco.AAEB also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.35922163
FireEye	Generic.mg.897096a23897a2a0
McAfee	GenericRXNE-MQ!897096A23897
Cylance	Unsafe
K7AntiVirus	Spyware ( 0040f0131 )
BitDefender	Trojan.GenericKD.35922163
K7GW	Spyware ( 0040f0131 )
CrowdStrike	win/malicious_confidence_60% (D)
Cyren	W32/Dridex.BD.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
Kaspersky	Trojan-Banker.Win32.RTM.htc
Alibaba	TrojanBanker:Win32/Kryptik.8cb8589b
Rising	Malware.Obscure/Heur!1.A89E (CLASSIC)
Ad-Aware	Trojan.GenericKD.35922163
Emsisoft	Trojan.GenericKD.35922163 (B)
DrWeb	Trojan.Inject4.6395
TrendMicro	TROJ_GEN.R002C0RLU20
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-R + Mal/EncPk-APV
Ikarus	Trojan.Win32.Crypt
MAX	malware (ai score=85)
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Program:Win32/Ymacco.AAEB
Gridinsoft	Trojan.Win32.Kryptik.oa
Arcabit	Trojan.Generic.D22420F3
ZoneAlarm	Trojan-Banker.Win32.RTM.htc
GData	Trojan.GenericKD.35922163
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZedlaF.34700.xE8@aysdlMgj
ALYac	Trojan.GenericKD.35922163
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HILY
TrendMicro-HouseCall	TROJ_GEN.R002C0RLU20
Tencent	Win32.Trojan-banker.Rtm.Ebqm
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Dridex.TWY!tr
AVG	Win32:BankerX-gen [Trj]
Paloalto	generic.ml
Qihoo-360	Generic/HEUR/QVM40.1.463B.Malware.Gen

How to remove Program:Win32/Ymacco.AAEB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Program:Win32/Ymacco.AAEB malicious file