Categories: Malware

Symmi.61457 removal guide

The Symmi.61457 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Symmi.61457 virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Yara rule detections observed from a process memory dump/dropped files/CAPE
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Chinese
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Symmi.61457?


File Info:
name: 0C4F9770EA0F28FE23B5.mlwpath: /opt/CAPEv2/storage/binaries/3ee630b0695fc05c49995aa39012307af7d70ce827a5fddc418d44e4a815110bcrc32: 3135FC08md5: 0c4f9770ea0f28fe23b5f04e9ee37e0esha1: f5126c2bad34e477f0af3af1591cd68cb69d3d9asha256: 3ee630b0695fc05c49995aa39012307af7d70ce827a5fddc418d44e4a815110bsha512: 7ae3d29be7506137a81e4fc6d1c3e5c60403ccd7c6eaac691c5baf579942d2a8594582ff957e8b17ab7e48d75350f37fa62bfe36d9f0ef93322fb134155ba1f0ssdeep: 12288:10EMINvGt02EziYB1cBMvlu5wGnAebBIUyrT3MSic:PACDtFA5wGNaZLRFtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T12994230BA9B82084E6B75FB683A3B63714DB60C03A7102B5F06D4B1D6357BE95B7C319sha3_384: 541ce4b6cb38a798cf158cf7d3730e507ba77c634d09c6491e0295b6d5e292d1ed71ddf04d72dd1896b92b842da651baep_bytes: 558bec81ec48010000eb108b0dac8144timestamp: 2010-10-16 22:24:12
Version Info:
CompanyName: Masnesaft CorporationFileDescription: Masnesaft Visual Studie 2010FileVersion: 1.9.43074.5121 built by: SP1RelInternalName: devenv.exeLegalCopyright: © Masnesaft Corporation. All rights reserved.OriginalFilename: devenv.exeProductName: Masnesaft® Visual Studio® 2010ProductVersion: 1.9.43074.5121Translation: 0x0409 0x04b0

Symmi.61457 also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Symmi.61457
FireEye	Generic.mg.0c4f9770ea0f28fe
CAT-QuickHeal	FraudTool.Security
McAfee	PWSZbot-FBTA!0C4F9770EA0F
Cylance	Unsafe
Sangfor	Trojan.Win32.Kryptik.CGXH
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Gen:Variant.Symmi.61457
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	AI:Packer.9ED2D7921F
VirIT	Trojan.Win32.Banker.AHD
Cyren	W32/A-fce284e8!Eldorado
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.CGXH
Baidu	Win32.Trojan.Kryptik.je
APEX	Malicious
ClamAV	Win.Trojan.Agent-1143456
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Crypted.dciuyr
Cynet	Malicious (score: 100)
Rising	Malware.Zbot!8.E95E (TFE:2:f4GomeOPXIH)
Ad-Aware	Gen:Variant.Symmi.61457
Sophos	ML/PE-A + Troj/Zbot-IPP
Comodo	TrojWare.Win32.Kryptik.CHIQ@5dpgs3
DrWeb	Trojan.Siggen6.15132
Zillya	Trojan.Zbot.Win32.161681
TrendMicro	TSPY_ZBOT.SMRAP
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Symmi.61457 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Generic.azwde
Webroot	Trojan.Dropper.Gen
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.3303
Microsoft	PWS:Win32/Zbot
SUPERAntiSpyware	Trojan.Agent/Gen-FalComp
GData	Gen:Variant.Symmi.61457
Google	Detected
AhnLab-V3	Dropper/Win32.Necurs.R113347
VBA32	BScope.TrojanPSW.Zbot
ALYac	Gen:Variant.Symmi.61457
MAX	malware (ai score=85)
Malwarebytes	Trojan.Zbot.Gen
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TSPY_ZBOT.SMRAP
Tencent	Trojan-ransom.Win32.Blocker.fgym
Yandex	Trojan.Agent!D+8J7wat5+I
Ikarus	Trojan-Spy.Win32.Zbot
Fortinet	W32/Kryptik.CJJL!tr
AVG	Win32:Mystic
Cybereason	malicious.0ea0f2
Avast	Win32:Mystic