Should I remove “Trojan.AzorultPMF.S25015837”?

The Trojan.AzorultPMF.S25015837 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.AzorultPMF.S25015837 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Urdu (India)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location

How to determine Trojan.AzorultPMF.S25015837?

File Info:
name: 85DBD51DE8867AD2F95A.mlw
path: /opt/CAPEv2/storage/binaries/a404346de4709d81426f4769006727904a018fbbd86db8194a0b24c00b774390
crc32: 70B3F664
md5: 85dbd51de8867ad2f95a44d9a0d656c0
sha1: 72574ffe2f49d3dd9e9a16becb9728ebf7715015
sha256: a404346de4709d81426f4769006727904a018fbbd86db8194a0b24c00b774390
sha512: 5959b4b117cd1b178bc6702b0b4b3ff3f4e3656be6dd93cc86c59126ba66c63b72ae8eaf90b1dba95a816350097e48dc4bef126cf5f6a24a9ef6cbe11300b79c
ssdeep: 3072:wXGe/n/3KWWhovhV71eOYOtlpPL2Ernpr/ni2:kH3ihovhzewpr/nt
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12FE3AF1032D18035D5A7563069B4EAA12E7ABC326675C18F73A452FF1FF02D1DAA13EB
sha3_384: a86bc11c5586f2528878e0fa99aed7ea93314ff753b6681c9cbc1d09228be390e8e7afab83a56de2f6d7204325867b20
ep_bytes: e8502a0000e989feffffcccccccccccc
timestamp: 2020-07-04 05:14:43

Version Info:
InternalName: bomgpiaruci.iwa
Copyright: Copyrighz (C) 2021, fudkat
ProductVersion: 13.54.77.27
Translation: 0x0114 0x046a

Trojan.AzorultPMF.S25015837 also known as:

How to remove Trojan.AzorultPMF.S25015837?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.