Categories: Trojan

Trojan.MauvaiseRI.S5257626 information

The Trojan.MauvaiseRI.S5257626 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.MauvaiseRI.S5257626 virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Tries to unhook or modify Windows functions monitored by Cuckoo
Attempts to modify proxy settings

Related domains:

www.12345ee.com

How to determine Trojan.MauvaiseRI.S5257626?


File Info:
crc32: F749C66Amd5: c402bd0459a0f5baa938c01aceea080cname: C402BD0459A0F5BAA938C01ACEEA080C.mlwsha1: 19a04fb6859368a64455a6520e324d607ecb3994sha256: 1a2c88315ecdd677333b459b54028a2281bbc64c1b3ce8ab24d27ce40b11fff2sha512: d1486cb65f9b41c2047eb255596aa54b8173a5f3278f21462f120ecf7634b7500eb29237647a3ec128b081fb92bc966092096a186a6ffd1268f33cde7844fda2ssdeep: 49152:Ne9NSWggiPDZrNTgcRdi6VgnhXj+s8KuqGaX0ToIBAUZLYtBb:0XSZBPdNvREhoJBAUZLQtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: x7248x6743x6240x6709xff1awww.12345aa.comFileVersion: 3.7.0.0CompanyName: www.12345aa.comComments: x672cx7a0bx5e8fx4f7fx7528x6613x8bedx8a00x7f16x5199(http://www.eyuyan.com)ProductName: x529bx738bQQx7fa4x53d1x5668ProductVersion: 3.7.0.0FileDescription: x529bx738bQQx7fa4x53d1x5668Translation: 0x0804 0x04b0

Trojan.MauvaiseRI.S5257626 also known as:

K7AntiVirus	Trojan ( 005246d51 )
Lionic	Trojan.Multi.Generic.lwj0
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.MauvaiseRI.S5257626
Cylance	Unsafe
Zillya	Tool.IMEStartup.Win32.961
Sangfor	RiskTool.Win32.IMEStartup.gen
CrowdStrike	win/malicious_confidence_70% (D)
K7GW	Trojan ( 005246d51 )
Cybereason	malicious.685936
Cyren	W32/Trojan.CLL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Generic-9820446-0
Kaspersky	not-a-virus:VHO:RiskTool.Win32.IMEStartup.gen
NANO-Antivirus	Trojan.Win32.Advload.fabxcs
Tencent	Win32.Trojan.Qqpsw.Auto
Sophos	Generic PUA BJ (PUA)
Comodo	TrojWare.Win32.Agent.OSCF@5rs7jr
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
FireEye	Generic.mg.c402bd0459a0f5ba
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_100%
Antiy-AVL	Trojan/Generic.ASCommon.FA
Microsoft	PUA:Win32/Vigua.A
GData	Win32.Application.PUPStudio.A
AhnLab-V3	PUP/RL.Generic.R242480
McAfee	Artemis!C402BD0459A0
MAX	malware (ai score=96)
VBA32	BScope.Trojan.Downloader
Malwarebytes	Trojan.MalPack.FlyStudio
TrendMicro-HouseCall	TROJ_GEN.R002H0CEO21
Rising	Stealer.QQpass!1.648F (CLASSIC)
MaxSecure	Dropper.Dinwod.frindll
Fortinet	W32/CoinMiner.ELG!tr.pws
AVG	Win32:Malware-gen
Paloalto	generic.ml