Strictor.236530 removal

The Strictor.236530 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Strictor.236530 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (4 unique times)
Creates RWX memory
Drops a binary and executes it
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Uses Windows utilities for basic functionality
Tries to suspend Cuckoo threads to prevent logging of malicious activity
Sniffs keystrokes
Tries to unhook or modify Windows functions monitored by Cuckoo
Creates a hidden or system file
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

jq.qq.com

www.bing.com

ocsp.dcocsp.cn

qm.qq.com

How to determine Strictor.236530?


File Info:
crc32: 023191EA
md5: 3582e9f6cb46a0d39424099a334263a8
name: hack_ot_nuba.exe
sha1: c2bb829ed436624e3dbfeed1eb648c3112e82308
sha256: 2ef8db0d90f4f4a37da21947662d9bd9fae17992fbdb3a0facb7c8a497b74a80
sha512: 8ede08d67082c37b783c613ef889373230b18f03047dc2fcf4752d53a1207b4fc514d379517df1959db78e4ed5be60b6c77c226ec1ba7d9e5264415024031560
ssdeep: 196608:5PdS0Idu+OI9r7dIkVVj/JtCI8D4S0yXt0h:5FS0IpOdkv/mI8DKit
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: x8ff7x604bx8f85x52a9x7f51 - www.asx0.com
FileVersion: 1.0.0.0
CompanyName: x8ff7x604bx8f85x52a9x7f51 - www.asx0.com
Comments: x8ff7x604bx8f85x52a9x7f51 - www.asx0.com
ProductName: x8ff7x604bx8f85x52a9x7f51 - www.asx0.com
ProductVersion: 1.0.0.0
FileDescription: x8ff7x604bx8f85x52a9x7f51 - www.asx0.com
Translation: 0x0804 0x04b0

Strictor.236530 also known as:

Bkav	HW32.Packed.
MicroWorld-eScan	Gen:Variant.Strictor.236530
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Adware ( 004b8e1b1 )
BitDefender	Gen:Variant.Strictor.236530
Cybereason	malicious.ed4366
Arcabit	Trojan.Strictor.D39BF2
ESET-NOD32	a variant of Win32/Packed.VMProtect.OM
APEX	Malicious
Rising	Trojan.Generic@ML.100 (RDML:Yb5XhyEPrESU9Qv2zPoFeA)
Endgame	malicious (high confidence)
Emsisoft	Gen:Variant.Strictor.236530 (B)
Comodo	TrojWare.Win32.Agent.ISVQ@5mbonp
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Generic.vc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.3582e9f6cb46a0d3
Sophos	Mal/VMProtBad-A
Ikarus	Trojan.Win32.Krypt
MAX	malware (ai score=84)
Microsoft	Trojan:Win32/Wacatac.D!ml
Acronis	suspicious
ALYac	Gen:Variant.Strictor.236530
Ad-Aware	Gen:Variant.Strictor.236530
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_99%
GData	Gen:Variant.Strictor.236530
BitDefenderTheta	Gen:NN.ZexaF.34084.@B0@ayLo26ob
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Strictor.236530?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.