Categories: Malware

What is “Troj/DwnLdr-YLF”?

The Troj/DwnLdr-YLF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Troj/DwnLdr-YLF virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to modify proxy settings
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Troj/DwnLdr-YLF?


File Info:
name: D3847F45B1FA1BCCC4CF.mlwpath: /opt/CAPEv2/storage/binaries/c3207e1a3f7d625bc8b856172e120cfa0475bf4a85aa1f799ba2b2b8a3095ac7crc32: 887483B1md5: d3847f45b1fa1bccc4cff9358e342954sha1: 084b27139f4ea19b5bd1cc86ccfd0e144b33152bsha256: c3207e1a3f7d625bc8b856172e120cfa0475bf4a85aa1f799ba2b2b8a3095ac7sha512: 29014ee26e25ac3b9f858546d4e4296d142be1ff30c6533ac5760c145ffe67d49fe4a65c0e2aa2eae41a96d81aff8b55559776fb724b573b16d50bfe67f9b3e2ssdeep: 12288:VLE8rKj25X0mcslMKTKK4KKDyK5FZ1EEEEmEEE1EEEEEEEEEEElKK1KKK1KKKaf/:VLEK42Gm52KTKK4KKDyK5FZ1EEEEmEEvtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T110C419253852D6E1FBD077B41694A6F0077FAC322E36E6EF52B032294B755D3C232866sha3_384: 5c5d6099ee00050c99f85aa632918a2ac5e3e6a29a4c014596bfdf162586dbdafffaf1f1406b8e0d4f4d35d8b45e1a75ep_bytes: 558bec81ec70090000e8b20c00008985timestamp: 1970-01-01 15:50:05
Version Info:
0: [No Data]

Troj/DwnLdr-YLF also known as:

Bkav	W32.SmallzerotND.PE
Lionic	Trojan.Win32.CliptoShuffler.tqXq
Cynet	Malicious (score: 100)
FireEye	Generic.mg.d3847f45b1fa1bcc
ALYac	Trojan.Patched.LH
Malwarebytes	Trojan.Downloader.RZ.Generic
Sangfor	Downloader.Win32.Patched.Vw3f
K7AntiVirus	Virus ( 0055485e1 )
Alibaba	TrojanDownloader:Win32/SmallAgent.3e03b9ea
K7GW	Trojan-Downloader ( 00552ecf1 )
Arcabit	Trojan.Patched.LH
VirIT	Win32.Nov15th.A
Cyren	W32/ZeroDloader.A.gen!Eldorado
Symantec	Infostealer
Elastic	malicious (high confidence)
ESET-NOD32	Win32/TrojanDownloader.Agent.EQH
APEX	Malicious
Kaspersky	Trojan.Win32.Patched.rw
BitDefender	Trojan.Patched.LH
NANO-Antivirus	Virus.Win32.Gen.ccmw
MicroWorld-eScan	Trojan.Patched.LH
Avast	Win32:DeadZero [Inf]
Tencent	Virus.Win32.Patched.kh
TACHYON	Worm/W32.ZeroDownloader
Emsisoft	Trojan.Patched.LH (B)
F-Secure	Malware.W32/Infector.Gen
DrWeb	Trojan.DownLoader33.36265
VIPRE	Trojan.Patched.LH
TrendMicro	TrojanSpy.Win32.FICKERSTEALER.SMTHA.hp
McAfee-GW-Edition	BehavesLike.Win32.Simfect.hm
Trapmine	malicious.high.ml.score
Sophos	Troj/DwnLdr-YLF
Ikarus	Trojan.Patched
Jiangmin	TrojanDownloader.Generic.bdga
Avira	W32/Infector.Gen
Antiy-AVL	Trojan[Downloader]/Win32.Agent.a
Microsoft	TrojanDownloader:Win32/SmallAgent!atmn
ZoneAlarm	Trojan.Win32.Patched.rw
GData	Win32.Trojan.PSE.1100EPL
Google	Detected
AhnLab-V3	Malware/Win32.RL_Generic.R282625
McAfee	Artemis!D3847F45B1FA
MAX	malware (ai score=82)
VBA32	BScope.TrojanBanker.CliptoShuffler
Cylance	unsafe
Panda	Generic Suspicious
Zoner	Trojan.Win32.133837
TrendMicro-HouseCall	TrojanSpy.Win32.FICKERSTEALER.SMTHA.hp
Rising	Worm.Phorpiex!1.BB1C (CLASSIC)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.EQH!tr
BitDefenderTheta	Gen:NN.ZexaF.36722.HyY@a03GJMki
AVG	Win32:DeadZero [Inf]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)