RemoteAdmin.Win32.WinVNC-based.j (file analysis)

The RemoteAdmin.Win32.WinVNC-based.j is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What RemoteAdmin.Win32.WinVNC-based.j virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Yara detections observed in process dumps, payloads or dropped files

How to determine RemoteAdmin.Win32.WinVNC-based.j?

File Info:
name: 2511AB6104224E2D3293.mlw
path: /opt/CAPEv2/storage/binaries/97cd544c9207a8371c2e540955ee9b15f22080e8f34a4b182e7f31fa2a0bf5e3
crc32: 5CD0BC39
md5: 2511ab6104224e2d329364192b5d5ed8
sha1: 5455c9e2037a4941673a6ea924922b2666ecc5ce
sha256: 97cd544c9207a8371c2e540955ee9b15f22080e8f34a4b182e7f31fa2a0bf5e3
sha512: 36b7b61069a6a71f5f242260074f9638ef3e51f1cff18cec6148522cd53b5d0d2e165b46e9ade81247fb1b5600c2d8e672d3b0409605055134cda86eb488982e
ssdeep: 6144:Qxs/J32yTk0mkFNC555lLtsRSeL5ICvzwLcHADqVWunBVGn:QIBFNaXf+75ICvAcHADqVb
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D9747D43F3D543B6E6AA26321477AB3295347D4A0E39D787A774EC6F9C31280E932346
sha3_384: fd143f91e3e2bd6601b7f777228645bb83bb11b00a64f52a2b544402316975ec009d8752918d3536e5a6ee6ecfb9844b
ep_bytes: 558bec6aff68c0d04300685c51430064
timestamp: 2004-11-25 13:45:33

Version Info:
Comments: by Quentin Stafford-Fraser
CompanyName: AT&T Laboratories Cambridge
FileDescription: vncviewer
FileVersion: 1, 3, 6, 0
InternalName: vncviewer
LegalCopyright: Copyright (C) 1999-2004 [many holders]
LegalTrademarks: 
OriginalFilename: vncviewer.exe
PrivateBuild: 
ProductName: TightVNC Win32 Viewer
ProductVersion: 1, 3, 6, 0
SpecialBuild: 
Translation: 0x0809 0x04b0

RemoteAdmin.Win32.WinVNC-based.j also known as:

How to remove RemoteAdmin.Win32.WinVNC-based.j?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.