About “Trojan.Win32.Mucc.vho” infection

The Trojan.Win32.Mucc.vho is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Win32.Mucc.vho virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan.Win32.Mucc.vho?


File Info:
name: 3945B9A6746BC0BC1F9A.mlw
path: /opt/CAPEv2/storage/binaries/2997d169c77dffeb7aa183a5740063e32ca19410b6b28bb5a44a8b8e751ddff3
crc32: AF9435AE
md5: 3945b9a6746bc0bc1f9a092575847073
sha1: c4bc12142848c168f6aaf2999a95f276a27488ad
sha256: 2997d169c77dffeb7aa183a5740063e32ca19410b6b28bb5a44a8b8e751ddff3
sha512: b5e9f9a58b2ea4447a6110c424f459c7fc058f1af4255f4367c853e3111425c3e4b2d0a963be9c72899b1e6f8ca55ad417c51d73f7c4f1630cc113078a523a37
ssdeep: 24576:qztqFZKfRPQzFyCPjQg8fBEDTgIkk8DRlvi2wdL+rkEHk9+:q4X1PQk9+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T185354A65F8AB54B9F60E52B24CE346AF333676055B33DAC3C6409AA5FD47BE02C32125
sha3_384: 180c32f95301fcbd5a428a3906be0a8512f301d8c5620214c9857260692a9c45ed041195c916b6f0bc655db1141d0339
ep_bytes: e9dbd8ffffcccccccccccccccccccccc
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Trojan.Win32.Mucc.vho also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Mucc.4!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.3945b9a6746bc0bc
Skyhigh	BehavesLike.Win32.Generic.th
McAfee	GenericRXLU-IZ!3945B9A6746B
Malwarebytes	Generic.Malware/Suspicious
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0001b1601 )
Alibaba	Trojan:Win32/Generic.4f3669e7
K7GW	Trojan ( 0001b1601 )
BitDefenderTheta	Gen:NN.ZexaF.36802.fvW@aODiZUe
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent.TSI
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Mucc.vho
NANO-Antivirus	Trojan.Win32.Ursu.hmfhws
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Mucc.Ltgl
F-Secure	Trojan.TR/Crypt.XPACK.Gen
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan.Mucc.ayy
Google	Detected
Avira	TR/Crypt.XPACK.Gen
Kingsoft	malware.kb.a.771
Microsoft	Trojan:Win32/Wacatac.B!ml
Xcitium	Malware@#142wv30e3k0jg
ZoneAlarm	HEUR:Trojan.Win32.Mucc.vho
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Wacatac.R351743
VBA32	BScope.Trojan.Tiggre
Rising	Trojan.Generic@AI.100 (RDMK:NaxRzLXyoxKbevtCPy/H0Q)
Yandex	Trojan.Agent!iRa4nLLQ9LE
Ikarus	Trojan.Win32.Agent
Fortinet	W32/Agent.TSI!tr
AVG	Win32:Trojan-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Trojan.Win32.Mucc.vho?

Trojan.Win32.Mucc.vho removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X