Categories: Malware

SoftwareBundler:Win32/FileTour removal

The SoftwareBundler:Win32/FileTour is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What SoftwareBundler:Win32/FileTour virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Creates RWX memory
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

ec2-35-176-106-236.eu-west-2.compute.amazonaws.com

How to determine SoftwareBundler:Win32/FileTour?


File Info:
crc32: 2878BD8Bmd5: 81b3b90796e58c32c9de78ac544532bfname: 81B3B90796E58C32C9DE78AC544532BF.mlwsha1: b323bfcc9a4b2cdddd04d8b9d194401d311a34edsha256: a1f0bf39d68965c9076587ea01744f6125db027f381d30aafb15e314ab85d6b3sha512: c8b140500dff5f6a897cc50fd6021834da97091b2336c5a5090c6e69a5d54285fb2df789c1f05cceee0b08c1cff96533a253cd0e5b1b5acb9b4298a6fba9fb3dssdeep: 24576:KLMgaMAfgiI08G2wzP27V9GUKSnmYm1c4u9Ux12LiX5nI7+OOBWWT4E0xQ9h+7H:ZoGDI0h7zuZ9rJnip8iXc8WW829EHbPtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

SoftwareBundler:Win32/FileTour also known as:

Bkav	W32.AIDetectVM.malware5
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ursu.914471
FireEye	Generic.mg.81b3b90796e58c32
McAfee	Adware-FileTour
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Adware ( 00511f971 )
K7GW	Adware ( 00511f971 )
CrowdStrike	win/malicious_confidence_100% (D)
Arcabit	Trojan.Ursu.DDF427
TrendMicro	TROJ_GEN.R06CC0PKI20
Cyren	W32/S-1a8ef509!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:AdwareSig [Adw]
Kaspersky	HEUR:Packed.Win32.Blackv.gen
BitDefender	Gen:Variant.Ursu.914471
Ad-Aware	Gen:Variant.Ursu.914471
Emsisoft	Gen:Variant.Ursu.914471 (B)
F-Secure	Heuristic.HEUR/AGEN.1116975
DrWeb	Trojan.Moneyinst.210
Invincea	Mal/EncPk-XF
McAfee-GW-Edition	Adware-FileTour
Sophos	Mal/EncPk-XF
Ikarus	not-a-virus:AdWare.FileTour
Jiangmin	AdWare.FileTour.ago
Avira	HEUR/AGEN.1116975
MAX	malware (ai score=83)
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	SoftwareBundler:Win32/FileTour
ZoneAlarm	HEUR:Packed.Win32.Blackv.gen
GData	Gen:Variant.Ursu.914471
Cynet	Malicious (score: 100)
AhnLab-V3	PUP/Win32.FileTour.R204168
BitDefenderTheta	AI:Packer.7354C5741F
ALYac	Gen:Variant.Ursu.914471
VBA32	TScope.Malware-Cryptor.SB
Malwarebytes	Adware.FileTour.BatBitRst
ESET-NOD32	a variant of Win32/Adware.FileTour.FFV
TrendMicro-HouseCall	TROJ_GEN.R06CC0PKI20
Rising	Adware.FileTour!1.ACB3 (CLASSIC)
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
AVG	Win32:AdwareSig [Adw]
Cybereason	malicious.796e58