Categories: Malware

About “Ser.Johnnie.5489” infection

The Ser.Johnnie.5489 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ser.Johnnie.5489 virus can do?

Injection (inter-process)
Injection (Process Hollowing)
Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Expresses interest in specific running processes
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Anomalous binary characteristics

Related domains:

dssp.workday360.cn

How to determine Ser.Johnnie.5489?


File Info:
crc32: D90D1B62md5: f3bf2cc6300ab7b335f7291f4696ecf4name: F3BF2CC6300AB7B335F7291F4696ECF4.mlwsha1: a73f14d234d34ccd0182cca1711fa23071e4fc22sha256: 1820c3b119f2feefd1754411537414fe194842f34894b33ec5f5b725cf1da54dsha512: 874ee89fae12a7e95f973313ceec460b64faef5ab9dd873b4ff08b637ecde920d3c349750abc131858e63afde532aaa2965ae403a4b41076a9676d9615e0e780ssdeep: 24576:npTzf+z6sq82g3rG7p8J7Et8qXB+P59IWVvOTB8erDQrn9igJ0V/WUzdbvrrMfj:n5T+fqLEa7MGXB+PvIetcmZ0fmjKSatype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Ser.Johnnie.5489 also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen9.49842
MicroWorld-eScan	Gen:Variant.Ser.Johnnie.5489
McAfee	GenericRXKP-OE!F3BF2CC6300A
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Gen:Variant.Ser.Johnnie.5489
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.6300ab
BitDefenderTheta	Gen:NN.ZexaF.34688.BvW@aWiKAkoj
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Inject.amyyj
Alibaba	Trojan:Win32/Inject.8dcdaeb1
NANO-Antivirus	Trojan.Win32.Injuke.hpnqvf
AegisLab	Trojan.Win32.Inject.4!c
Ad-Aware	Gen:Variant.Ser.Johnnie.5489
Emsisoft	Gen:Variant.Ser.Johnnie.5489 (B)
F-Secure	Trojan.TR/Dropper.Gen
TrendMicro	TROJ_GEN.R002C0PLE20
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Cipduk
Jiangmin	Trojan.Inject.bdsm
Avira	TR/Dropper.Gen
MAX	malware (ai score=89)
Antiy-AVL	Trojan/Win32.Inject
Kingsoft	Win32.Heur.KVMH017.a.(kcloud)
Gridinsoft	Trojan.Win32.Wacatac.vb
ZoneAlarm	Trojan.Win32.Inject.amyyj
GData	Gen:Variant.Ser.Johnnie.5489
VBA32	BScope.Trojan.Invader
ALYac	Gen:Variant.Ser.Johnnie.5489
Malwarebytes	Trojan.Injector
ESET-NOD32	a variant of Generik.LAUVRRJ
TrendMicro-HouseCall	TROJ_GEN.R002C0PLE20
Tencent	Win32.Trojan.Inject.Auto
Yandex	Trojan.Agent!IwRrVwR7mR4
SentinelOne	Static AI – Malicious PE
Fortinet	PossibleThreat.MU
Webroot	W32.Malware.Gen
AVG	Win32:Dh-A [Heur]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/Trojan.e04