Categories: Trojan

Trojan.Win32.Kolovorot.pg (file analysis)

The Trojan.Win32.Kolovorot.pg is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Kolovorot.pg virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Behavioural detection: Injection (inter-process)
Attempts to modify proxy settings
Harvests cookies for information gathering

How to determine Trojan.Win32.Kolovorot.pg?


File Info:
name: B54679D958256D7E9F04.mlwpath: /opt/CAPEv2/storage/binaries/c1b219179a0482daa7b68eb00d97403fda579346056d75eb87dab2ca8c4e3133crc32: 1E99E1F5md5: b54679d958256d7e9f04ae13af307dbesha1: e233085ec5320525a2f50ed527ade98b1e514fcesha256: c1b219179a0482daa7b68eb00d97403fda579346056d75eb87dab2ca8c4e3133sha512: 6d9787c2cd430135ac3fd5a996e234d691ddf5fe7d728628343a3491e39af11d8e1604de060477773d4a0dd418dbabeecb40c3728af0274b57e17eb88997cd06ssdeep: 49152:9EUOOX2DsKBPsTgpxG/p2/eOZfN0OsJba:RGDs4HG0mOZfNtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F0E5AF02F6D2C0F5E75E153209AF273AAA78DA414B24DBC3A364EE7D5D325C0A937217sha3_384: 73bdf2702d2bba6fda04b764184182ea66b1ec1fd3631438a62b0eadac54173cf5dd1e3655ee445cf9dfcdd8d473b6eaep_bytes: 558bec6aff6860d467006824c7460064timestamp: 2010-05-18 15:37:41
Version Info:
FileVersion: 1.0.0.0FileDescription: 无极工作室6.1ProductName: 无极工作室6.1ProductVersion: 1.0.0.0LegalCopyright: 作者版权所有 请尊重并使用正版Comments: 本程序为个人自行编写的应用程序,感谢大家使用Translation: 0x0804 0x04b0

Trojan.Win32.Kolovorot.pg also known as:

Bkav	W32.AIDetect.malware1
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Heur.PWSIME.2
FireEye	Generic.mg.b54679d958256d7e
Cylance	Unsafe
Zillya	Trojan.Kolovorot.Win32.135
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 005246d51 )
Alibaba	Trojan:Win32/Kolovorot.84c19f63
K7GW	Trojan ( 005246d51 )
Cybereason	malicious.958256
Baidu	Win32.Trojan.Agent.apv
Cyren	W32/S-6174ea28!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/FlyStudio.Injector.A potentially unwanted
APEX	Malicious
ClamAV	Win.Malware.Flystudio-9752414-0
Kaspersky	Trojan.Win32.Kolovorot.pg
BitDefender	Gen:Heur.PWSIME.2
NANO-Antivirus	Trojan.Win32.BlackHole.cuetck
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Kolovorot.Vylw
Ad-Aware	Gen:Heur.PWSIME.2
Emsisoft	Gen:Heur.PWSIME.2 (B)
Comodo	Malware@#2gazfjm73i6cu
DrWeb	Trojan.DownLoader5.38831
VIPRE	Gen:Heur.PWSIME.2
McAfee-GW-Edition	BehavesLike.Win32.MultiDropper.wm
Trapmine	suspicious.low.ml.score
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan.Win32.Vilsel
Google	Detected
Avira	TR/Obfuscate.xzoue
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASCommon.FA
Microsoft	Trojan:Win32/Dynamer!dtc
Arcabit	Trojan.PWSIME.2
GData	Gen:Heur.PWSIME.2
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZexaF.34682.fl0aa4mKkfib
ALYac	Gen:Heur.PWSIME.2
VBA32	Trojan.Wacatac
Malwarebytes	Malware.AI.3420618405
Rising	Malware.Undefined!8.C (TFE:5:WvwXdvx0wDE)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/BlackHole.RTQ!tr.bdr
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_70% (D)