Trojan.Win32.Cometer.hio (file analysis)

The Trojan.Win32.Cometer.hio is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Cometer.hio virus can do?

• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to modify proxy settings

How to determine Trojan.Win32.Cometer.hio?

File Info:
name: 9A084FC06BC7DE20FF84.mlw
path: /opt/CAPEv2/storage/binaries/abba5483bc1df07d0065b1a7b7bcb735a1305fc674a4c38a9c1dd75790f51966
crc32: 541F1732
md5: 9a084fc06bc7de20ff845506125e0ae3
sha1: f88a89b47b7697615dea0e016ad4ac7a44826832
sha256: abba5483bc1df07d0065b1a7b7bcb735a1305fc674a4c38a9c1dd75790f51966
sha512: 44bbc93f191134c61c028be7db9f7134954d574dbb735c17cd56093f40f2ed2f5ff9dc4a7a7dd99c008003e4407ae425c7c337e5f45cbfd9c3e1f08c66cb422b
ssdeep: 24576:OoJBu2XV04jnHW8VwBYcha3sM6zlYzLhQ0zJ68VQWWRWqMZ:pu4jHmSchcsvWkq3Z
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18335D013B9D184B2F1470972453AA73B7E35A7006A25CE8BE7C05D680A77290EA3F79D
sha3_384: 540d19b3c4396ce489d2ae6d6d8109a85ca65e691e075715ea019135f19f2fa75cbe0fb398f086adc6d84df80d5e7e5e
ep_bytes: e88a020000e98efeffff558becff7508
timestamp: 2020-06-21 17:46:30

Version Info:
CompanyName: Simon Tatham
ProductName: PuTTY suite
FileDescription: SSH, Telnet and Rlogin client
InternalName: PuTTY
OriginalFilename: PuTTY
FileVersion: Release 0.74 (with embedded help)
ProductVersion: Release 0.74
LegalCopyright: Copyright © 1997-2020 Simon Tatham.
Translation: 0x0809 0x04b0

Trojan.Win32.Cometer.hio also known as:

How to remove Trojan.Win32.Cometer.hio?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.