Trojan-Dropper.Win32.Gamaredon (file analysis)

The Trojan-Dropper.Win32.Gamaredon is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Dropper.Win32.Gamaredon virus can do?

• Sample contains Overlay data
• Reads data out of its own binary image
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid

How to determine Trojan-Dropper.Win32.Gamaredon?

File Info:
name: 56CBEBDE4D1A45A56E26.mlw
path: /opt/CAPEv2/storage/binaries/c511b71b2aaabe39308f1d500536b7bd17e5d233eed275e8bffc4e1150de03a3
crc32: 70BEA1F5
md5: 56cbebde4d1a45a56e26aba4d8f9f18f
sha1: 9cbf950d7ba2e381e7a5ccecfbff1848842fd6e4
sha256: c511b71b2aaabe39308f1d500536b7bd17e5d233eed275e8bffc4e1150de03a3
sha512: 32f18833d9c434074de13428a6ad5af1d621ab9aa1bec5f592cc4b6bfa44bfe12ed9f304db50896d12645ebb1c7a6d6fcb866a5970fbcd9f6c6605fa6cb4324b
ssdeep: 98304:h4YCH+vb2IZaguVcfrRY4YCH+vb2IZaguVcfrU:hlCHeqlCHeU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14336182036FF8D2BE4A2587C192C97BE1265BAB52B6A50C353D80D1D3A747FE4731D22
sha3_384: f5d715a248f24c3ffb18f09266687f26c9d5646e8158fdb367391c875164527a60c109c361ecaaa5526c86712eca7725
ep_bytes: e8fa060000e97afeffffc3cccccccccc
timestamp: 2020-07-29 07:23:42

Version Info:
CompanyName: IRay
FileDescription: TAS Installer
FileVersion: 2.0
InternalName: TAS_V2.0_Win64
LegalCopyright: Copyright (C) 2022 IRay
OriginalFileName: TAS_V2.0_Win64.exe
ProductName: TAS
ProductVersion: 2.0
Translation: 0x0804 0x04b0

Trojan-Dropper.Win32.Gamaredon also known as:

How to remove Trojan-Dropper.Win32.Gamaredon?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.