Trojan.RansomKD.12534613 (file analysis)

The Trojan.RansomKD.12534613 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.RansomKD.12534613 virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
Reads data out of its own binary image
Drops a binary and executes it
Performs some HTTP requests
Unconventionial binary language: Arabic (Algeria)
Unconventionial language used in binary resources: Norwegian (Bokmal)
The binary likely contains encrypted or compressed data.
Installs itself for autorun at Windows startup
Attempts to modify proxy settings

Related domains:

download.mozilla.org

download.cdn.mozilla.net

How to determine Trojan.RansomKD.12534613?


File Info:
crc32: E6CB7573
md5: 2ce5bc04a78fd797efeca58a6b6c0f47
name: 2CE5BC04A78FD797EFECA58A6B6C0F47.mlw
sha1: 680c0405416f0c865173d8dc3ea9f41c776b1433
sha256: 3a0a82681eb13056b97780ec5c65ddc3a7bca81477256b1418d6a86c53e31733
sha512: f2e24cab57a26b9bc9996a536f68f27ca8faae178c109847bd9b33eb604a9cddf0049e1dc6a3f1d42640f490ce473f94236ef8e1324cc51795876859bc3e8dbc
ssdeep: 6144:pKwLo7Yp0yN90QEJdBlwkktV7i9RxjMYBPDFWxBMnqJkOQ+Yiep97vGp9MGJY09:5Loly90TdURpiZzwkl5iep8tq09Z0t
type: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive

Version Info:
LegalCopyright: x202dxa9 Microsoft Corporation. All rights reserved.x202c
InternalName: Wextract                
FileVersion: 8.00.7600.16385 (win7_rtm.090713-1255)
CompanyName: Microsoft Corporation
ProductName: Windowsxae Internet Explorer
ProductVersion: 8.00.7600.16385
FileDescription: x200ex200ex627x644x627x633x62ax62ex631x627x62c x627x644x630x627x62ax64a x644x645x644x641 x62ex632x627x646x629 Win32                                           
OriginalFilename: WEXTRACT.EXE            .MUI
Translation: 0x0401 0x04b0

Trojan.RansomKD.12534613 also known as:

K7AntiVirus	Trojan ( 0055e39a1 )
Lionic	Trojan.Win32.Blocker.j!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Starter.2890
Cynet	Malicious (score: 99)
ALYac	Trojan.RansomKD.12534613
Cylance	Unsafe
Zillya	Trojan.Generic.Win32.16483
Sangfor	Trojan.Win32.Generic.ky
K7GW	Trojan ( 0055e39a1 )
Cybereason	malicious.4a78fd
Cyren	W32/Trojan.FDP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Injector.CNK
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Trojan.Bladbindi-1
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.RansomKD.12534613
NANO-Antivirus	Trojan.Win32.Dwn.dbxzfj
MicroWorld-eScan	Trojan.RansomKD.12534613
Tencent	Win32.Trojan.Generic.Hvtl
Ad-Aware	Trojan.RansomKD.12534613
Sophos	Generic ML PUA (PUA)
Comodo	Malware@#3sv9l13w8i2f4
F-Secure	Trojan.TR/Dropper.MSIL.Gen
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	PWSZbot-FAXB!BFD0AD2CB3DB
FireEye	Generic.mg.2ce5bc04a78fd797
Emsisoft	Trojan.RansomKD.12534613 (B)
SentinelOne	Static AI – Malicious SFX
Avira	TR/Dropper.MSIL.Gen
eGambit	RAT.njRat
Antiy-AVL	Trojan/Generic.ASMalwS.A18696
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Backdoor:MSIL/Bladabindi
Arcabit	Trojan.RansomKD.DBF4355
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.RansomKD.12534613
McAfee	Artemis!2CE5BC04A78F
MAX	malware (ai score=84)
VBA32	Hoax.Blocker
Rising	Dropper.Runp!1.9DE7 (CLASSIC)
Yandex	Trojan.Blocker!iN74NXqjIjM
Fortinet	MSIL/Injector.CNK!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/Backdoor.NjRAT.HwYDEpsA

How to remove Trojan.RansomKD.12534613?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan.RansomKD.12534613 (file analysis)