Categories: Malware

About “PWS:Win32/Kegotip” infection

The PWS:Win32/Kegotip is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Kegotip virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
A process attempted to delay the analysis task.
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
HTTPS urls from behavior.
Manipulates data from or to the Recycle Bin
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Attempts to modify proxy settings
Operates on local firewall’s policies and settings
Harvests information related to installed mail clients

How to determine PWS:Win32/Kegotip?


File Info:
name: 3E2B75AC98284145DD5F.mlwpath: /opt/CAPEv2/storage/binaries/fda58bf8b39e3db435e0f55ce6c445b9eb0090ae58fd6cdf3fa48db8c616b595crc32: 8DF8B97Bmd5: 3e2b75ac98284145dd5f265de60f233fsha1: ac6af47e16e474b3d6b0a37c5dad965e5798b990sha256: fda58bf8b39e3db435e0f55ce6c445b9eb0090ae58fd6cdf3fa48db8c616b595sha512: 2f62e3c682675a62f683a49d3d9f2ba0b727bb58200a06a9e771d20093a353d84beb5365a2784bc96c45a8c5213292b3dadcf3965273597b151b603f2e758370ssdeep: 3072:y94J3wbLTIgPjpeeqGOY0/BvDF5ysx2rkRviokeR:NSPTI+9+Y0Jbmjr8Setype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T11FF34C03FBBC1CE5E3E6263D19FE4299E417993B6206C1C32C8D5359E18D3724EA9A5Csha3_384: e60e5cc6dd69967d7fd373569a3ea8ecd38bada3ddc6a57386d7a796b143a6fbde3bd495a949f89d88077118ec04a21bep_bytes: e822500100e9f73a0100cccccccccccctimestamp: 2012-05-31 18:20:03
Version Info:
0: [No Data]

PWS:Win32/Kegotip also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.3e2b75ac98284145
CAT-QuickHeal	TrojanPWS.Kegotip.WR4
McAfee	PWSZbot-FOK!3E2B75AC9828
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.1847279
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0055dd191 )
Alibaba	TrojanPSW:Win32/Kryptik.8bc56454
K7GW	Trojan ( 0055dd191 )
Cybereason	malicious.c98284
VirIT	Trojan.Win32.Crypt3.RDZ
Symantec	Downloader.Upatre!gen5
ESET-NOD32	a variant of Win32/Kryptik.CCHF
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Mikey.81222
NANO-Antivirus	Trojan.Win32.Stealer.czcuwb
MicroWorld-eScan	Gen:Variant.Mikey.81222
Avast	Win32:Agent-AUID [Trj]
Tencent	Win32.Trojan.Jaike.Lkxv
Ad-Aware	Gen:Variant.Mikey.81222
Emsisoft	Gen:Variant.Mikey.81222 (B)
Comodo	Malware@#1gn527frhan5d
DrWeb	Trojan.PWS.Stealer.3277
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_SPNR.0BIQ14
McAfee-GW-Edition	PWSZbot-FOK!3E2B75AC9828
Sophos	Mal/Generic-R + Mal/Zbot-QL
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Mikey.81222
Jiangmin	Trojan.Generic.kydv
eGambit	Generic.Malware
Avira	HEUR/AGEN.1213603
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.A083C1
Kingsoft	Win32.Troj.Undef.(kcloud)
Arcabit	Trojan.Mikey.D13D46
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	PWS:Win32/Kegotip
BitDefenderTheta	Gen:NN.ZexaF.34212.kqW@aq3R97li
ALYac	Gen:Variant.Mikey.81222
VBA32	BScope.TrojanPSW.Stealer
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	TROJ_SPNR.0BIQ14
Rising	Trojan.Kryptik!8.8 (CLOUD)
Yandex	Trojan.Kryptik!93A/F6FCGcE
Ikarus	Backdoor.Win32.Androm
Fortinet	W32/Kryptik.CCEY!tr
Webroot	W32.Infostealer.Zeus
AVG	Win32:Agent-AUID [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_70% (D)