Categories: Malware

Should I remove “Symmi.65685”?

The Symmi.65685 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Symmi.65685 virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Reads data out of its own binary image
Unconventionial language used in binary resources: Arabic
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking

Related domains:

z.whorecord.xyz

a.tomx.xyz

www.sertanejomisturado.com.br

How to determine Symmi.65685?


File Info:
crc32: 06A64C16md5: 5f61a894ad717b38fdad9cc6a0e98492name: 5F61A894AD717B38FDAD9CC6A0E98492.mlwsha1: 5050d7ae7eebc1037264dfa886ac9934e8780de6sha256: 746cbbe6cbedea4d5f801da9b8a8e1c761c04c52d9743a3f8ed3ff24cff3eeecsha512: e8244179f76e5d270f3e6a5a5a2554cf87666a55a057765d7acc7d23045219b7fff00b84aa9d22061c7fbbba50fe6ea20793f9dd77c13b1a4881329da255b386ssdeep: 12288:xaWzgMg7v3qnCiMErQohh0F4CCJ8lnyfQ6NyDz+6qc3cX4nLqPHIpjup3NhYLLf:gaHMv6CorjqnyfQqyu6x3M4nL8wyhcLftype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
CompiledScript: AutoIt v3 Script: 3, 3, 6, 1FileVersion: 3, 3, 6, 1FileDescription: Translation: 0x0809 0x04b0

Symmi.65685 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Symmi.65685
FireEye	Generic.mg.5f61a894ad717b38
McAfee	Artemis!5F61A894AD71
Cylance	Unsafe
Zillya	Trojan.AutoIT.Win32.28858
AegisLab	Trojan.Win32.Autoit.4!c
Sangfor	Malware
K7AntiVirus	Trojan ( 700000111 )
BitDefender	Gen:Variant.Symmi.65685
K7GW	Trojan ( 700000111 )
Cybereason	malicious.4ad717
Cyren	W32/Trojan.ZCCE-5696
Symantec	Infostealer.Domingo
TrendMicro-HouseCall	TROJ_UTOTI.TYZAV
Avast	Win32:Broban-A [Trj]
ClamAV	Win.Trojan.Gamarue-6964332-0
Kaspersky	HEUR:Trojan.Win32.Autoit.gen
Alibaba	TrojanDownloader:Win32/Banload.97d5a154
NANO-Antivirus	Trojan.Win32.Autoit.czndnz
Tencent	Win32.Trojan.Autoit.Syrx
Ad-Aware	Gen:Variant.Symmi.65685
Sophos	Troj/AutoIt-AAV
Comodo	Malware@#1k2h89vp2civy
F-Secure	Dropper.DR/AutoIt.Gen
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_UTOTI.TYZAV
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Emsisoft	Gen:Variant.Symmi.65685 (B)
Ikarus	Win32.SuspectCrc
Jiangmin	Trojan.Autoit.iuo
Webroot	W32.Trojan.GenKD
Avira	DR/AutoIt.Gen
MAX	malware (ai score=80)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Glupteba!ml
Gridinsoft	Trojan.Win32.Downloader.oa
Arcabit	Trojan.Symmi.D10095
ZoneAlarm	HEUR:Trojan.Win32.Autoit.gen
GData	Gen:Variant.Symmi.65685
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Symmi.65685
VBA32	Trojan.Autoit.Banker
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/CI.A
APEX	Malicious
ESET-NOD32	Win32/TrojanDownloader.Banload.TNI
Fortinet	W32/Autoit.AAV!tr
AVG	Win32:Broban-A [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (D)
Qihoo-360	Win32/Worm.AutoIt.HwoCGzEA