Trojan-Spy.Win32.Noon.araa malicious file

The Trojan-Spy.Win32.Noon.araa is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.Noon.araa virus can do?

Executable code extraction
Creates RWX memory
Unconventionial language used in binary resources: Urdu (Pakistan)
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan-Spy.Win32.Noon.araa?


File Info:
crc32: 929F149A
md5: 772ac8c8a2e770092e9394c2212605c6
name: win.exe
sha1: 805fea9deed20a3e7a0ecd80513c2462e84d1b3f
sha256: a6346505b1bc3d2b3cfbdbb2c03934be512206b69a940a8ae9c3900eaa78b03a
sha512: 830b8f3de8900aff4b3cd9a5d34ae6a1f5e66a44c8b25bd3701304bed33b081e0132465ac44b8729c4482abbbc424527b1b1907b7e258612b1d8a088955864d8
ssdeep: 6144:NYVWqmVdSN3SVFBQVSmekqBGDy9gALLOm/Hn8aw/OsY/Os:mYVG8zQVt8BGDy9nLXm/OsY/Os
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
ProductVersion: 1.00
InternalName: koerljk
FileVersion: 1.00
OriginalFilename: koerljk.exe
ProductName: Doea

Trojan-Spy.Win32.Noon.araa also known as:

MicroWorld-eScan	Trojan.GenericKD.32763464
FireEye	Trojan.GenericKD.32763464
ALYac	Trojan.Agent.FormBook
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.32763464
K7GW	Riskware ( 0040eff71 )
BitDefenderTheta	Gen:NN.ZevbaF.32515.Cm0@au6pDnoO
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.DYSS
TrendMicro-HouseCall	TROJ_GEN.R002H06KR19
Paloalto	generic.ml
GData	Trojan.GenericKD.32763464
Kaspersky	Trojan-Spy.Win32.Noon.araa
Ad-Aware	Trojan.GenericKD.32763464
Sophos	Mal/Generic-S
DrWeb	Trojan.Siggen8.58044
VIPRE	Backdoor.VB.Tofsee.f (v)
McAfee-GW-Edition	BehavesLike.Win32.Generic.gh
SentinelOne	DFI – Suspicious PE
Trapmine	malicious.moderate.ml.score
Cyren	W32/Trojan.PUWQ-6660
Arcabit	Trojan.Generic.D1F3EE48
AegisLab	Trojan.Win32.Generic.4!c
ZoneAlarm	Trojan-Spy.Win32.Noon.araa
Microsoft	Trojan:Win32/Fuery.C!cl
AhnLab-V3	Win-Trojan/VBKrand.Gen
Acronis	suspicious
McAfee	Fareit-FQG!772AC8C8A2E7
MAX	malware (ai score=85)
Malwarebytes	Trojan.Crypt
Ikarus	Win32.Outbreak
AVG	FileRepMalware
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	HEUR/QVM03.0.81F7.Malware.Gen

How to remove Trojan-Spy.Win32.Noon.araa?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan-Spy.Win32.Noon.araa malicious file