Categories: Malware

Should I remove “Troj/Dyreza-FP”?

The Troj/Dyreza-FP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Troj/Dyreza-FP virus can do?

Sample contains Overlay data
Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Portuguese (Brazilian)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Attempts to modify proxy settings
Mimics icon used for popular non-executable file format
Anomalous binary characteristics

How to determine Troj/Dyreza-FP?


File Info:
name: A019AF064D50CAEB159A.mlwpath: /opt/CAPEv2/storage/binaries/55782f1ee28863153d51f86cb5b8abce4c2e544256381a8671af4960fb17e26dcrc32: 4D7D2716md5: a019af064d50caeb159a9d2877f22ad9sha1: 8088db05476a88e1fb742cc5530869e85416a8d8sha256: 55782f1ee28863153d51f86cb5b8abce4c2e544256381a8671af4960fb17e26dsha512: 963410474fd70c76ee0e7102fd13ae4c31b39ead01c989ccc0c5ff35201f5e741a824560629020f75548e288d48cd788ecfeb0742471973eddf80c81158d037bssdeep: 1536:dXWgMPCFGpu1diKRknkuL10/O1Q4Kk4jgRtLbXneZCgl:dm5C8Qd2kuC/O1HHghltype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T11463F6C5F794C0F6E0227834D4318ED3463B782E7E60019A67987639FFBA6C18A79356sha3_384: 3f6a276683351b08a97bfe12ae0cf8a7e1bfdb893e3bc82337ea8fbc7a9e9d97c0fd88356bf6214c2e1aff2d8124050aep_bytes: e8ccf2ffffe9b7f3ffffcccccccccccctimestamp: 2014-06-21 19:29:38
Version Info:
FileDescription: DAVT Corp.InternalName: DAVT UtilityFileVersion: 1.0.0.10CompanyName: DAVTLegalCopyright: Copyright 2014-2015 DAVTOriginalFilename: davtil.exeProductName: DAVT Corp.ProductVersion: 1.0.0.10Translation: 0x0423 0x04b1

Troj/Dyreza-FP also known as:

Bkav	W32.AIDetectMalware
DrWeb	Trojan.Upatre.3504
MicroWorld-eScan	Trojan.Upatre.Gen.3
FireEye	Generic.mg.a019af064d50caeb
CAT-QuickHeal	Trojan.Kadena.B4
ALYac	Trojan.Upatre.Gen.3
Malwarebytes	Crypt.Trojan.Malicious.DDS
Zillya	Trojan.Kryptik.Win32.745418
K7AntiVirus	Trojan ( 004c75411 )
K7GW	Trojan ( 004c5f921 )
Cybereason	malicious.64d50c
BitDefenderTheta	Gen:NN.ZexaF.36250.em1@a0N5YMpG
Cyren	W32/Upatre.AT.gen!Eldorado
Symantec	Downloader.Upatre!gen5
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.DMJN
APEX	Malicious
ClamAV	Win.Downloader.Upatre-9909423-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Upatre.Gen.3
NANO-Antivirus	Trojan.Win32.Upatre.dtajuu
SUPERAntiSpyware	Trojan.Agent/Gen-Upatre
Avast	Win32:Evo-gen [Trj]
Tencent	Malware.Win32.Gencirc.10bebd16
Emsisoft	Trojan.Upatre.Gen.3 (B)
F-Secure	Trojan.TR/Kryptik.abboik
Baidu	Win32.Trojan.Kryptik.jn
VIPRE	Trojan.Upatre.Gen.3
TrendMicro	TROJ_UPATRE.SM37
McAfee-GW-Edition	BehavesLike.Win32.Upatre.km
Trapmine	malicious.high.ml.score
Sophos	Troj/Dyreza-FP
SentinelOne	Static AI – Suspicious PE
GData	Trojan.Upatre.Gen.3
Jiangmin	TrojanDownloader.Upatre.ybg
Google	Detected
Avira	TR/Kryptik.abboik
Antiy-AVL	Trojan/Win32.SGeneric
Xcitium	TrojWare.Win32.TrojanDownloader.Upatre.KMJ@5s5qya
Arcabit	Trojan.Upatre.Gen.3
ViRobot	Trojan.Win32.Upatre.68096.BZ
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	TrojanDownloader:Win32/Upatre
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Upatre.R154505
McAfee	Upatre-FACM!A019AF064D50
MAX	malware (ai score=83)
VBA32	TrojanDownloader.Upatre
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_UPATRE.SM37
Rising	Malware.FakePDF/ICON!1.A24C (CLASSIC)
Yandex	Trojan.GenAsa!9IVMGl8FYtw
Ikarus	PUA.Bundler
Fortinet	W32/Waski.A!tr
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)