Categories: Malware

About “Symmi.15988” infection

The Symmi.15988 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Symmi.15988 virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)

How to determine Symmi.15988?


File Info:
name: 37063E843ECABCE219AF.mlwpath: /opt/CAPEv2/storage/binaries/bc8e917012a1ef9bb792f16d3d47048a3196e3a2af94fd340768f8d1a96d538bcrc32: F60AE1B6md5: 37063e843ecabce219afbe7f09759acesha1: bd14eb1729f476abf061fcf437f499d6e8eeed48sha256: bc8e917012a1ef9bb792f16d3d47048a3196e3a2af94fd340768f8d1a96d538bsha512: 395baeec4eac9eedab321176629a8d138de23b4ad8af1d05ccab8592c915d6e1cb89de749a096f8bd3cf9e3b6a615de0412d863034719cfc44b6acd72882e901ssdeep: 3072:aesDPG3ydbbqz8TeElsp0dC8IhCddX/DVPEHMxkYg5D09jAEEwxGBjpIXNNSjtRH:twghCddXJmMxvgv6xgdwSRDsgfBQtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T168049E657242C066D97D06F1C85FC0F602A47E66C744A0EBB2D1FF7B3DB29AA0532A74sha3_384: e5869fc241e7ec5282da7c3f28cf91b8fa5edf72c88cc1659bb572fd13c39d97fe353c424e82a57d2a7449f467b86d04ep_bytes: 558bec6aff68a8d0410068ae1c400064timestamp: 2008-10-31 09:33:54
Version Info:
CompanyName: Trend MicroFileDescription: Trend Micro AntiVirus Plus AntiSpywareFileVersion: 18.40.0.1301InternalName: 7zsfx.exeLegalCopyright: Copyright (C) 1995-2008 Trend Micro Incorporated. All rights reserved.LegalTrademarks: Copyright (C) Trend Micro Inc.OriginalFilename: 8lox.exePrivateBuild: Build 1400 - 8/27/2008ProductName: Trend Micro Internet SecurityProductVersion: 18.40SpecialBuild: 1301Translation: 0x0409 0x04e4

Symmi.15988 also known as:

Bkav	W32.MassiveUsbM.Worm
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Symmi.15988
FireEye	Generic.mg.37063e843ecabce2
CAT-QuickHeal	Trojan.Rimecud.AA
McAfee	W32/Worm-FFJ!37063E843ECA
Cylance	Unsafe
VIPRE	Gen:Variant.Symmi.15988
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 0040f5bf1 )
K7GW	Trojan ( 0040f5bf1 )
CrowdStrike	win/malicious_confidence_70% (W)
Cyren	W32/A-f0bc322d!Eldorado
Symantec	W32.Pilleuz!gen37
ESET-NOD32	a variant of Win32/Kryptik.AVIR
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Symmi.15988
NANO-Antivirus	Trojan.Win32.MlwGen.cqiwep
SUPERAntiSpyware	Trojan.Agent/Gen-Rimecud
Avast	Win32:MalPack-F [Trj]
Tencent	Win32.Worm-P2P.Palevo.uvu
Ad-Aware	Gen:Variant.Symmi.15988
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.Zbot.JHMO@4x5s0x
DrWeb	Win32.HLLW.Autoruner.44048
TrendMicro	TROJ_RIMECUD.SMN
McAfee-GW-Edition	W32/Worm-FFJ!37063E843ECA
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Symmi.15988 (B)
SentinelOne	Static AI – Suspicious PE
GData	Gen:Variant.Symmi.15988
Webroot	W32.Infostealer.Zeus
Avira	TR/Crypt.EPACK.Gen8
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Generic.ASMalwS.3303
Microsoft	Trojan:Win32/Rimecud.A
Google	Detected
AhnLab-V3	Trojan/Win32.Inject.R43586
VBA32	BScope.Trojan.Tiggre
ALYac	Gen:Variant.Symmi.15988
Malwarebytes	Trojan.Rimecud
TrendMicro-HouseCall	TROJ_RIMECUD.SMN
Rising	Malware.Undefined!8.C (TFE:1:utpPmLRH00B)
Yandex	Worm.P2P.Palevo!FLMknCzZO9k
Ikarus	Virus.Win32.Cryptor
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.EQMA!tr
BitDefenderTheta	Gen:NN.ZexaF.34606.lq0@a0sr!agi
AVG	Win32:MalPack-F [Trj]
Cybereason	malicious.43ecab
Panda	Trj/Genetic.gen