Categories: Trojan

How to remove “Trojan.Win32.DiskWriter.pef”?

The Trojan.Win32.DiskWriter.pef is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.DiskWriter.pef virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
NtSetInformationThread: attempt to hide thread from debugger
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Rhaeto (Romance)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Installs itself for autorun at Windows startup
CAPE detected the Lockbit malware family

How to determine Trojan.Win32.DiskWriter.pef?


File Info:
name: D62A93DBAFBAE87D1BBC.mlwpath: /opt/CAPEv2/storage/binaries/5deadf5ee6186bb9923923cbc392a96a67df6df041dca7edbda82e4e33f97e95crc32: B60C9BFCmd5: d62a93dbafbae87d1bbcafcc5ed37e41sha1: b60b1d1f6a89c5a93f894730efd655c178ea0fc0sha256: 5deadf5ee6186bb9923923cbc392a96a67df6df041dca7edbda82e4e33f97e95sha512: 97239ba61ab44d508563051655c4943e551628b99985837b00d7161ebd8f5881761b2e27cebf4501626bf7ce3a8ab91d0185a038026735c3e9fafcc3ef5b4d65ssdeep: 3072:EqLgjx44UZZJilUZieZLEMWIBkWFzS34oBjF6QgofvPvQtb5EMEkGj:yjx4hZIUZieK5YiXBxvfvIGtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T13324BF1130E4C432E5E72A3684B1C7B84EBBB86639226ACF5FD556B95F247D2C72430Esha3_384: 7c13f0f4893831707331110f82afdb65ad7dfa76e79f11b05cbe9f54bfb13a64b1dc92ac8ddfc75eef41baa7fc4c7d0fep_bytes: e8b4280000e978feffffcccccce83700timestamp: 2019-08-14 03:33:26
Version Info:
Translations: 0x0147 0x01f2

Trojan.Win32.DiskWriter.pef also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.DelShad.4!c
tehtris	Generic.Malware
MicroWorld-eScan	Trojan.GenericKDZ.71247
FireEye	Generic.mg.d62a93dbafbae87d
CAT-QuickHeal	Ransom.Stop.P5
ALYac	Trojan.Ransom.LockBit
Cylance	Unsafe
VIPRE	Trojan.GenericKDZ.71247
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0056f9be1 )
Alibaba	Trojan:Win32/Glupteba.c120a851
K7GW	Trojan ( 0056f9be1 )
Cybereason	malicious.bafbae
BitDefenderTheta	Gen:NN.ZexaF.34806.nqW@aavXdIPG
Cyren	W32/Kryptik.CGP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.HHHF
TrendMicro-HouseCall	Backdoor.Win32.GLUPTEBA.SMTH.hp
Paloalto	generic.ml
ClamAV	Win.Dropper.Generickdz-9789082-0
Kaspersky	HEUR:Trojan.Win32.DiskWriter.pef
BitDefender	Trojan.GenericKDZ.71247
NANO-Antivirus	Trojan.Win32.DelShad.iejrst
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
Avast	Win32:TrojanX-gen [Trj]
Tencent	Win32.Trojan.Diskwriter.Wpje
Ad-Aware	Trojan.GenericKDZ.71247
Emsisoft	Trojan.GenericKDZ.71247 (B)
Comodo	Malware@#2cuwullweaq8k
DrWeb	Trojan.Encoder.33065
TrendMicro	Backdoor.Win32.GLUPTEBA.SMTH.hp
McAfee-GW-Edition	BehavesLike.Win32.Lockbit.dc
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
APEX	Malicious
Jiangmin	Backdoor.Tofsee.dbm
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1209978
MAX	malware (ai score=83)
Microsoft	Trojan:Win32/Glupteba.KMG!MTB
GData	Win32.Trojan.Kryptik.QG
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R355136
Acronis	suspicious
McAfee	Lockbit-FSUC!D62A93DBAFBA
VBA32	BScope.Trojan.Glupteba
Malwarebytes	Trojan.MalPack
Ikarus	Trojan-Spy.MSIL.Agent
Rising	Malware.Obscure!1.A3BB (CLASSIC)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/CoinMiner.HIZL!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)