About “Riskware.PackagingUntrustworthyYandex” infection

The Riskware.PackagingUntrustworthyYandex is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Riskware.PackagingUntrustworthyYandex virus can do?

• Sample contains Overlay data
• Presents an Authenticode digital signature
• Performs HTTP requests potentially not found in PCAP.
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Attempts to modify proxy settings
• Anomalous binary characteristics

How to determine Riskware.PackagingUntrustworthyYandex?

File Info:
name: 01771404C510B01AB26B.mlw
path: /opt/CAPEv2/storage/binaries/300b18d89dc69df4e178f7a515ff2c5843f452a8ea97ac2746ebf9a69b3503ab
crc32: D1D3904F
md5: 01771404c510b01ab26be4afb4ce9543
sha1: 8fea690e1d6aab2fcf46c75a1767ec365d027684
sha256: 300b18d89dc69df4e178f7a515ff2c5843f452a8ea97ac2746ebf9a69b3503ab
sha512: 23a467223774b2325837b855691b07111030283e14a41f97e8d5a24f1e15837b363607f47e009c467ae1d360491a79ae25b15ebe557ef47ccda0e343b5e74fe4
ssdeep: 3072:EgCkOMhaMkqFTMv4UQC2mC4UAONf03xPQcZ1gviDM1g3OqA2KGEv2KnVW8itdlMU:D7WMkqFTPJMhPQw1gvblUtXF/Xz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1793459217C81C432C0B31A34C9E5D2F16978BD708E658A8F63987F2F3E771926625E67
sha3_384: 8e5a12c4bbd89c85061802c4c189aebeba8eef7b736d7207757a54f18bd3a9d04fbc6486e1cf589fd62ce10f48160c5b
ep_bytes: e82e030000e98efeffffff2508424200
timestamp: 2023-06-02 10:37:53

Version Info:
FileDescription: Setup Downloader
FileVersion: 0.1.0.33
InternalName: download
LegalCopyright: Copyright (C) 2015 Yandex LLC
OriginalFilename: downloader.exe
ProductName: Setup Downloader
ProductVersion: 0.1.0.33
Translation: 0x0419 0x04b0

Riskware.PackagingUntrustworthyYandex also known as:

How to remove Riskware.PackagingUntrustworthyYandex?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.