Trojan

Should I remove “Trojan.Heur.RP.hmKfbCLyZtii”?

Malware Removal

The Trojan.Heur.RP.hmKfbCLyZtii is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan.Heur.RP.hmKfbCLyZtii virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Sniffs keystrokes
  • Installs itself for autorun at Windows startup
  • Uses suspicious command line tools or Windows utilities

How to determine Trojan.Heur.RP.hmKfbCLyZtii?



File Info:

name: EB05215E79089A67FA5F.mlw
path: /opt/CAPEv2/storage/binaries/93dcf775c9fa988237ca6748f5b257a748e0e820c5d7395443bef2412b492c47
crc32: 310A9F7E
md5: eb05215e79089a67fa5fe70ed3b85afe
sha1: 8837df961135a1c13ce9d18fb154f67cb94b34df
sha256: 93dcf775c9fa988237ca6748f5b257a748e0e820c5d7395443bef2412b492c47
sha512: af9a9b3b6a582e73e49fcbf681542363ad32e00935ff29f506abc7ac30f58bbdcb6d1f978564ef571967135183c20cb6001f4144e3e232d1deba42b1b96dd5ee
ssdeep: 3072:GWJw2V5HriXfz2lAF4u/A5WEqPXiunrMQjY1JKMabxiRzu:GWK2V5LARF4u/A50PyaAQOKMWxa
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17CC31211BB961108D75A87B0AFA0EF8A327978C98E3D1B9C426793D4ADB4C41FD17CD2
sha3_384: f759ee4859b0cf3602f51b6cbe8f2c2c7590e83b76f98339b1271f6952b57114916857cff05754da7eb8c2985c11babf
ep_bytes: 60be00a043008dbe0070fcff57eb0b90
timestamp: 2007-11-10 01:26:17


Version Info:

CompanyName: Ron Sat Abel
FileDescription: Stain Divot
FileVersion: 5.9
InternalName: Mire
LegalCopyright: Copyright © Her Cord 1998-2005
OriginalFilename: Kebob.exe
ProductName: Chase Fix
ProductVersion: 5.9
Translation: 0x0409 0x04b0

Trojan.Heur.RP.hmKfbCLyZtii also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Jorik.ljaD
Elasticmalicious (high confidence)
DrWebTrojan.Winlock.3784
CynetMalicious (score: 100)
FireEyeGeneric.mg.eb05215e79089a67
ALYacGen:Trojan.Heur.RP.hmKfbCLyZtii
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforTrojan.Win32.Generic.ky
K7AntiVirusTrojan ( 0055dd191 )
AlibabaVirTool:Win32/Obfuscator.273b5a47
K7GWTrojan ( 0055dd191 )
Cybereasonmalicious.e79089
BitDefenderThetaAI:Packer.4A66449A1F
VirITTrojan.Win32.Generic.BZYK
CyrenW32/Zbot.DA.gen!Eldorado
SymantecTrojan.Gen
ESET-NOD32a variant of Win32/Kryptik.QTE
Paloaltogeneric.ml
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Trojan.Heur.RP.hmKfbCLyZtii
NANO-AntivirusTrojan.Win32.Gimemo.fuwxa
MicroWorld-eScanGen:Trojan.Heur.RP.hmKfbCLyZtii
AvastFileRepMetagen [Malware]
TencentWin32.Trojan.Generic.Ajld
Ad-AwareGen:Trojan.Heur.RP.hmKfbCLyZtii
EmsisoftGen:Trojan.Heur.RP.hmKfbCLyZtii (B)
ComodoTrojWare.Win32.Trojan.XPACK.Gen@2ho5ur
ZillyaTrojan.Gimemo.Win32.608
SophosMal/Generic-R + Mal/EncPk-AAI
IkarusTrojan-Ransom.Gimemo
GDataGen:Trojan.Heur.RP.hmKfbCLyZtii
JiangminTrojan/Gimemo.zg
WebrootW32.Malware.Gen
AviraTR/Crypt.ULPM.Gen
ArcabitTrojan.Heur.RP.hmKfbCLyZtii
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftPWS:Win32/Zbot!ml
VBA32Trojan.Zeus.EA.0999
MAXmalware (ai score=100)
MalwarebytesMalware.Heuristic.1003
APEXMalicious
RisingTrojan.Kryptik!8.8 (CLOUD)
YandexTrojan.Gimemo!kCBkS5x1i50
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.2919897.susgen
FortinetW32/Gimemo.BUW!tr
AVGFileRepMetagen [Malware]
PandaGeneric Malware
CrowdStrikewin/malicious_confidence_60% (W)

How to remove Trojan.Heur.RP.hmKfbCLyZtii?

Trojan.Heur.RP.hmKfbCLyZtii removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment