Categories: Trojan

Trojan-Dropper.Win32.Dapato.cmr removal tips

The Trojan-Dropper.Win32.Dapato.cmr is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Dropper.Win32.Dapato.cmr virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Performs HTTP requests potentially not found in PCAP.
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Checks the version of Bios, possibly for anti-virtualization
Detects VMware through the presence of a file
Attempts to modify proxy settings
Operates on local firewall’s policies and settings
Deletes executed files from disk
Harvests cookies for information gathering

How to determine Trojan-Dropper.Win32.Dapato.cmr?


File Info:
name: 29A8FBDD57070D0B1A90.mlwpath: /opt/CAPEv2/storage/binaries/ab26ef1ee76bb8e39c15f8e07500495fac55760197419dae8870c0effc5a08c3crc32: 4A26A401md5: 29a8fbdd57070d0b1a90eecd7e5be625sha1: 13782125f7051b6fde7e7543cc790c5467f015d2sha256: ab26ef1ee76bb8e39c15f8e07500495fac55760197419dae8870c0effc5a08c3sha512: 2596b8819c0eb9e28516bec556b16eb075b76d35a58b2c1a88777225b55109f13c8004cb288adac3768944e460b4395d35334fa21c17e5aec8103408995b1adassdeep: 768:5z1EN68TuryJXf1aVlwBDB1DLMKmnmojv+LLLHAZeNUdrHfZ7uDsz/1qzISW59b:4NvYyJNaVsbDo1XjvaAYU10DqxSW59btype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T15933E096EAAC2679FAA7C3307677169BA1313F449A35017ECF06B13D2D308509A4B5B3sha3_384: 2f2a00533fd0791bbea95040a9109dbdedd67f16d123ff1c47757cfba9b826b8922f954da0e7bd1374a630ce1019d14fep_bytes: 60be006058008dbe00b0e7ff5783cdfftimestamp: 1990-04-14 19:47:45
Version Info:
CompanyName: FileDescription: SDL_ttfFileVersion: 2, 0, 7, 0InternalName: SDL_ttfLegalCopyright: Copyright © 2002 Sam LantingaOriginalFilename: SDL_ttf.dllProductName: Simple DirectMedia LayerProductVersion: 2, 0, 7, 0Translation: 0x0409 0x04b0

Trojan-Dropper.Win32.Dapato.cmr also known as:

Lionic	Heuristic.File.Generic.00×1!p
DrWeb	Trojan.Packed.21790
MicroWorld-eScan	Gen:Variant.Bulz.69605
FireEye	Generic.mg.29a8fbdd57070d0b
CAT-QuickHeal	TrojanDownloader.Stegvob.AA3
McAfee	Artemis!29A8FBDD5707
Cylance	Unsafe
VIPRE	Gen:Variant.Bulz.69605
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0054cb111 )
Alibaba	TrojanDropper:Win32/Dapato.fb6689a7
K7GW	Trojan ( 0054cb111 )
Cybereason	malicious.d57070
BitDefenderTheta	Gen:NN.ZexaF.34682.dmKfa8LpIYn
VirIT	Trojan.Win32.Packed.BGGC
Cyren	W32/Zbot.BX.gen!Eldorado
Symantec	Trojan.Bredolab
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Kryptik.AKIV
APEX	Malicious
ClamAV	Win.Malware.Razy-7004488-0
Kaspersky	Trojan-Dropper.Win32.Dapato.cmr
BitDefender	Gen:Variant.Bulz.69605
NANO-Antivirus	Trojan.Win32.Dapato.jwluo
Avast	FileRepMalware [Wrm]
Tencent	Win32.Trojan-Dropper.Dapato.Simw
Ad-Aware	Gen:Variant.Bulz.69605
Sophos	Troj/Agent-RNY
Comodo	Packed.Win32.MUPX.Gen@24tbus
Baidu	Win32.Trojan.Kryptik.adl
Zillya	Dropper.Dapato.Win32.4000
McAfee-GW-Edition	PWS-Zbot.gen.axi
Trapmine	suspicious.low.ml.score
Emsisoft	Gen:Variant.Bulz.69605 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	TrojanDropper.Dapato.abbu
Webroot	W32.Trojan.Dapato.Gen
Google	Detected
Avira	TR/Crypt.ULPM.Gen5
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.35
Kingsoft	Win32.Troj.Generic.(kcloud)
Microsoft	TrojanDownloader:Win32/Stegvob.A
Arcabit	Trojan.Bulz.D10FE5
GData	Gen:Variant.Bulz.69605
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Zbot.R7346
VBA32	BScope.Trojan.Zbot.01367
ALYac	Gen:Variant.Bulz.69605
Malwarebytes	Malware.Heuristic.1003
Rising	Downloader.Stegvob!8.9EB (TFE:5:p0AKkZPiquL)
Yandex	Trojan.DR.Dapato!LCkRQ3S/P58
Ikarus	Trojan-Downloader.Win32.Rimod
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Bredo.P!tr
AVG	FileRepMalware [Wrm]
Panda	Trj/Banker.JJG
CrowdStrike	win/malicious_confidence_90% (W)