Malware

Symmi.3599 removal instruction

Malware Removal

The Symmi.3599 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Symmi.3599 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Uses Windows utilities for basic functionality
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the embedded win api malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Symmi.3599?


File Info:

name: 4F4C5CBA6CC865416905.mlw
path: /opt/CAPEv2/storage/binaries/bed449f3dc73c4671c21bbbc766f40847ab7fe5e4ce0ffd91a5ba4b7d0480bcb
crc32: 45DB16FD
md5: 4f4c5cba6cc865416905293dccf5ba32
sha1: e123c6e35a5332858d0d30853820d15a71e2ec21
sha256: bed449f3dc73c4671c21bbbc766f40847ab7fe5e4ce0ffd91a5ba4b7d0480bcb
sha512: 5e70c83f2dedce86e4fc3b0ee634f70cefee3a2520ef268eedd239c08dd9bcb97505ff3a13984e85778fbe7578dd14f868e263b19ef1131d364901d743eb1458
ssdeep: 3072:NnFu4GKoQUZuaOdMHUsq9ZUIs8u7K8J+hhZY:G4GUU9isCu7l+XZY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T167F3E042FF82CD2ED43106F80A72C778AF65BDA069BA12E3B715F36CDDB1641982E544
sha3_384: ca7deec7fa143b711460e7892a50d86aa7fae2bf11ca094fdf0e10dad13e621d3ff988b7744f5d9457eb94a7f1ef7812
ep_bytes: eb168b1500304200ff328f0500304200
timestamp: 1992-06-19 22:22:17

Version Info:

0: [No Data]

Symmi.3599 also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.VBKrypt.ldUT
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Symmi.3599
FireEyeGeneric.mg.4f4c5cba6cc86541
SkyhighBehavesLike.Win32.Infected.ch
McAfeeArtemis!4F4C5CBA6CC8
Cylanceunsafe
VIPREGen:Variant.Symmi.3599
SangforSuspicious.Win32.Save.a
AlibabaBackdoor:Win32/Bifrose.ec85319f
K7GWTrojan ( 7000000f1 )
K7AntiVirusTrojan ( 7000000f1 )
SymantecBackdoor.Bifrose
tehtrisGeneric.Malware
ESET-NOD32a variant of Win32/Packed.Molebox.K suspicious
APEXMalicious
TrendMicro-HouseCallBKDR_BIFROSE.AQR
AvastWin32:Bifrose-AAI [Trj]
ClamAVWin.Trojan.Mybot-13476
KasperskyBackdoor.Win32.Rbot.aliu
BitDefenderGen:Variant.Symmi.3599
NANO-AntivirusTrojan.Win32.Bifrose.ijiag
TencentMalware.Win32.Gencirc.1401ab1b
EmsisoftGen:Variant.Symmi.3599 (B)
F-SecureHeuristic.HEUR/AGEN.1348652
DrWebTrojan.DownLoader.50961
ZillyaBackdoor.RBot.Win32.25555
TrendMicroBKDR_BIFROSE.AQR
Trapminemalicious.high.ml.score
SophosTroj/Bifrose-UP
Paloaltogeneric.ml
MAXmalware (ai score=100)
JiangminTrojanDropper.VB.qhf
WebrootW32.Rbot.Gen
GoogleDetected
AviraHEUR/AGEN.1348652
VaristW32/Backdoor.ZYDR-5708
Antiy-AVLTrojan[Backdoor]/Win32.Rbot
KingsoftWin32.Hack.Rbot.aliu
MicrosoftBackdoor:Win32/Multiverze
XcitiumBackdoor.Win32.Trojan.Rbot.~A@zk69
ArcabitTrojan.Symmi.DE0F
ZoneAlarmBackdoor.Win32.Rbot.aliu
GDataGen:Variant.Symmi.3599
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Antisb.R73086
BitDefenderThetaAI:Packer.D9FDADCA1D
ALYacGen:Variant.Symmi.3599
TACHYONTrojan-Spy/W32.KeyLogger.171520.B
VBA32Backdoor.Rbot
MalwarebytesMalware.Heuristic.2046
PandaTrj/CI.A
ZonerProbably Heur.ExeHeaderL
RisingTrojan.DL.Win32.Mnless.fhz (CLOUD)
IkarusTrojan-Clicker.AMEI
MaxSecureTrojan.Malware.1410261.susgen
FortinetW32/Bifrose.BBT!tr
AVGWin32:Bifrose-AAI [Trj]
DeepInstinctMALICIOUS
alibabacloudBackdoor:Win/Rbot.aliu

How to remove Symmi.3599?

Symmi.3599 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment