Categories: Malware

About “Symmi.17583” infection

The Symmi.17583 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Symmi.17583 virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Dynamic (imported) function loading detected
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine Symmi.17583?


File Info:
name: CB4BD9000D816B884E17.mlwpath: /opt/CAPEv2/storage/binaries/07cae6fb2fe2f59a0e23b98e7de93bc73ba83a4ddd19897df6194dc0bbe37da7crc32: 022C2863md5: cb4bd9000d816b884e1742a8ede34650sha1: 2c4acfd23d83f949a30d1c2f975e0031d953082csha256: 07cae6fb2fe2f59a0e23b98e7de93bc73ba83a4ddd19897df6194dc0bbe37da7sha512: 4a7a447d5b8a7a0a659bf225be088a3aa38325d3b9fd22f720c550793fe1c23794d7a0127c521146e7d46200feae07c9a19ffeac182060e07949b3e0074b5b8assdeep: 6144:rMMFLegDb6egS82HT0wXVbIsGuhMtRoG1HUjlyqSIP6c:oY7LgSXHnl0lBtRGjkqrytype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17C5402107C848FA9C2D4DE73C297B520A267E8557222DB5FE1DAD37A2819390CF5374Dsha3_384: 8d897681dca8021625b15ef88e603f7991b29da0b341b66e3a5073267bc803c772194bfac3d6a9e22c1a176e2119d20bep_bytes: 558bec6aff68c8114000681524400064timestamp: 2001-01-10 02:43:56
Version Info:
CompanyName: Wvwl JbxbFileDescription: OxdicSurwbrvxz Ainzue TnsrewxzFileVersion: InternalName: OxdicLegalCopyright: Copyright Wvwl JbxbOriginalFilename: Oxdic.exeProductName: Oxdic ProductVersion: Translation: 0x0409 0x04b0

Symmi.17583 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Zbot.4!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.cb4bd9000d816b88
McAfee	PWS-Zbot-FASG!CB4BD9000D81
Cylance	Unsafe
VIPRE	Trojan.Win32.Reveton.a (v)
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanSpy:Win32/Kryptik.543cd283
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (D)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.AZKB
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Spy.Win32.Zbot.lbdl
BitDefender	Gen:Variant.Symmi.17583
NANO-Antivirus	Trojan.Win32.Zbot.bppyfw
MicroWorld-eScan	Gen:Variant.Symmi.17583
Avast	FileRepMalware
Tencent	Win32.Trojan-spy.Zbot.Szbn
Ad-Aware	Gen:Variant.Symmi.17583
Emsisoft	Gen:Variant.Symmi.17583 (B)
Comodo	Malware@#3w12bog33heaf
DrWeb	Trojan.PWS.Panda.3734
Zillya	Trojan.Zbot.Win32.169941
TrendMicro	TROJ_FRS.0NA103BL20
McAfee-GW-Edition	PWS-Zbot-FASG!CB4BD9000D81
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Win32.Zbot
GData	Gen:Variant.Symmi.17583
Jiangmin	TrojanSpy.Zbot.fmae
Webroot	W32.Infostealer.Zeus
Avira	BDS/ZeroAccess.Gen7
Antiy-AVL	Trojan/Generic.ASMalwS.1BEC7D
Kingsoft	Win32.Troj.Zbot.lb.(kcloud)
Arcabit	Trojan.Symmi.D44AF
ZoneAlarm	Trojan-Spy.Win32.Zbot.lbdl
Microsoft	PWS:Win32/Zbot!GO
TACHYON	Trojan-Spy/W32.ZBot.289280.AC
AhnLab-V3	Spyware/Win32.Zbot.C166991
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34212.ruW@aWHvgegi
ALYac	Gen:Variant.Symmi.17583
MAX	malware (ai score=100)
VBA32	BScope.Malware-Cryptor.Hlux
Malwarebytes	Malware.Heuristic.1008
TrendMicro-HouseCall	TROJ_FRS.0NA103BL20
Rising	Spyware.Zbot!8.16B (CLOUD)
Yandex	TrojanSpy.Zbot!xmZPBAbnnFo
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W32/Kryptik.AZWE!tr
AVG	FileRepMalware
Cybereason	malicious.00d816
Panda	Generic Malware