Trojan.Win32.Cometer.ght information

The Trojan.Win32.Cometer.ght is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Cometer.ght virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Created a process from a suspicious location
• Attempts to modify proxy settings

How to determine Trojan.Win32.Cometer.ght?

File Info:
name: AA28CC4BF6D2AFA6EDAD.mlw
path: /opt/CAPEv2/storage/binaries/27d5474bf2051e52a6034dbf8b4e3862147373cb25c13b64f9fb950615bc8f80
crc32: 59EAD477
md5: aa28cc4bf6d2afa6edad72477b26e616
sha1: 131b0851d3f4d2592d6602b8be4756af3f62e854
sha256: 27d5474bf2051e52a6034dbf8b4e3862147373cb25c13b64f9fb950615bc8f80
sha512: 78fdec634d75154b64b984047d248ea0e6ce616ec479c8c34c660efaee23e7d170078bb61610559db74f554a6fc83272962176860baa174a926b95dab5627d3f
ssdeep: 12288:hge+eY4r0QTkC0SBH3skyvNRM3RkVMA1XJBuM72B/wbcsPKLuf2A2EoS+:UeVQ8kw1lyvgRoPF2B/wbcsPIE2p
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T15AF433A66E579255E6B412FE44D6F1C0BE3CC02ACB408D0B9EA30DC3F93545CA9BE25D
sha3_384: cb89599fbe3f2c63bf509fe9739e39712d7539ec78c859e1bf71fb748567d6650340baba8d0be266ee76c3dac7ba3a74
ep_bytes: 60be155041008dbeebbffeff5789e58d
timestamp: 2018-02-01 20:18:05

Version Info:
0: [No Data]

Trojan.Win32.Cometer.ght also known as:

How to remove Trojan.Win32.Cometer.ght?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.