SwBndlr.ICLoader.S3225804 malicious file

The SwBndlr.ICLoader.S3225804 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What SwBndlr.ICLoader.S3225804 virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Queries information on disks, possibly for anti-virtualization
Behavior consistent with a dropper attempting to download the next stage.
Detects the presence of Wine emulator via registry key
Checks the version of Bios, possibly for anti-virtualization
Attempts to modify proxy settings
Collects information to fingerprint the system

Related domains:

z.whorecord.xyz

a.tomx.xyz

static.43.47.69.159.clients.your-server.de

How to determine SwBndlr.ICLoader.S3225804?


File Info:
crc32: 1009E54E
md5: 25d75f0fb9495d607c1d864bc4827ac9
name: 25D75F0FB9495D607C1D864BC4827AC9.mlw
sha1: c91446e5758bff4b9b55b1f62ac405bc7e535131
sha256: 1a527b2bb8ed51591af4cd329db829fb147c23023a169ba50231a41104ab4e0d
sha512: 57d93475739c88ab724fc4b7d32532d967db507b859e93fa3b3f76c00f84ceae6a1bb179044ef5365325ed3d48f6cc6294ba71ea58d5afe083f266a7c8a15243
ssdeep: 12288:/JLP1YurrSUwu5gFG9QHGwpM406Ys1fntVu0p55pJ5emBaghkh0YBajgofZ58I/r:LYuXFw2IVhacYgnL54gE0qajgof1e8d
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

SwBndlr.ICLoader.S3225804 also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Ekstak.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.InstallCube.3658
CAT-QuickHeal	SwBndlr.ICLoader.S3225804
ALYac	Application.Bundler.ICLoader.4.Gen
Cylance	Unsafe
Zillya	Trojan.Ekstak.Win32.58359
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/Ekstak.e4a8d824
K7GW	Trojan ( 0053926b1 )
K7AntiVirus	Trojan ( 0053926b1 )
Cyren	W32/FusionCoreDownldr.C.gen!Eldorado
ESET-NOD32	a variant of Win32/Kryptik.GJIY
APEX	Malicious
Avast	Win32:DangerousSig [Trj]
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Ekstak.icsk
BitDefender	Application.Bundler.ICLoader.4.Gen
NANO-Antivirus	Trojan.Win32.Kryptik.fgttxq
MicroWorld-eScan	Application.Bundler.ICLoader.4.Gen
Tencent	Trojan.Win32.Kryptik.gjbs
Ad-Aware	Application.Bundler.ICLoader.4.Gen
Comodo	Application.Win32.ICLoader.GS@84429a
BitDefenderTheta	Gen:NN.ZexaF.34236.irX@a8s3uOki
TrendMicro	PUA.Win32.ICLoader.SMA
McAfee-GW-Edition	BehavesLike.Win32.Packed.tc
FireEye	Generic.mg.25d75f0fb9495d60
Emsisoft	Application.FileTour (A)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Ekstak.ntr
Avira	TR/ICLoader.Gen8
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASBOL.C4FA
Microsoft	SoftwareBundler:Win32/ICLoader
ZoneAlarm	HEUR:Packed.Win32.Katusha.gen
GData	Win32.Application.ICLoader.F
AhnLab-V3	PUP/Win32.ICLoader.R233134
Acronis	suspicious
McAfee	Packed-FHK!25D75F0FB949
MAX	malware (ai score=100)
VBA32	BScope.Trojan.Ekstak
Malwarebytes	Adware.FileTour
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	PUA.Win32.ICLoader.SMA
Rising	Trojan.Kryptik!1.AA23 (CLASSIC)
Yandex	Trojan.GenAsa!qRhw/JPiPUE
Ikarus	PUA.FileTour
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/CoinMiner.GYQC!tr
AVG	Win32:DangerousSig [Trj]
Paloalto	generic.ml

How to remove SwBndlr.ICLoader.S3225804?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

SwBndlr.ICLoader.S3225804 malicious file