Categories: Trojan

About “TrojanDownloader:Win32/Horst.M” infection

The TrojanDownloader:Win32/Horst.M is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Horst.M virus can do?

Sample contains Overlay data
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
Attempts to modify proxy settings
Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDownloader:Win32/Horst.M?


File Info:
name: 9F09E533512C5B9375EB.mlwpath: /opt/CAPEv2/storage/binaries/0ef4d6d0c4f8450888f1ce83959e9ec4483234bd11640d186b2ca17b0bbbd6c4crc32: 982BF5D5md5: 9f09e533512c5b9375eb8dc99c303ddesha1: c6ee74415f5e4b80bcd21d9951c64c1596b28341sha256: 0ef4d6d0c4f8450888f1ce83959e9ec4483234bd11640d186b2ca17b0bbbd6c4sha512: bf5b1400c5d520c71d1be33d934b44abc4a317f746eac1897674d2e860a2c00ea0c59727429144e1e95cb763fde6b57ea0152d8d593a99549a22d2b26b93976bssdeep: 768:TlOATBQghI0yTSSApqALQHRBq1h2OPxc7bmqhizJFZn:gUBjhIX7oqoKZOPSvm11Fhtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T142538D2378D2D076C842457012A58E86A77B782053F186D3ABA8159FEF762E0DF3E357sha3_384: 76a1c0aa9eb6644fe28c5992f7e26d6d27ca8415d553309f1566f80b9b48a543fdb9c46f1da4ac7dfaef066362e37b2bep_bytes: 6a606830844000e8c3040000bf940000timestamp: 2006-12-01 08:26:19
Version Info:
0: [No Data]

TrojanDownloader:Win32/Horst.M also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Calac.lK2k
MicroWorld-eScan	Gen:Trojan.ExplorerHijack.dmX@aC@Jdje
FireEye	Generic.mg.9f09e533512c5b93
CAT-QuickHeal	Downloader.Horst.30617
Skyhigh	BehavesLike.Win32.Generic.kt
McAfee	GenericRXAA-FA!9F09E533512C
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 004bcce41 )
Alibaba	TrojanDownloader:Win32/Horst.e9f4042d
K7GW	Trojan ( 004bcce41 )
Cybereason	malicious.3512c5
VirIT	Trojan.Win32.Agent.HEI
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Medbot.DF
APEX	Malicious
ClamAV	Win.Proxy.Horst-233
Kaspersky	Trojan-Downloader.Win32.Agent.aii
BitDefender	Gen:Trojan.ExplorerHijack.dmX@aC@Jdje
NANO-Antivirus	Trojan.Win32.Agent.wacc
Avast	Win32:Agent-EFH [Trj]
Tencent	Malware.Win32.Gencirc.11b8263b
Emsisoft	Gen:Trojan.ExplorerHijack.dmX@aC@Jdje (B)
Google	Detected
F-Secure	Trojan.TR/Hijack.Agen.35512
DrWeb	Trojan.DownLoader.19461
Zillya	Trojan.Medbot.Win32.336
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
Ikarus	Trojan.Win32.Medbot
Jiangmin	TrojanDownloader.Agent.ix
Varist	W32/Downloader.RLOI-5866
Avira	TR/Hijack.Agen.35512
Antiy-AVL	Trojan[Downloader]/Win32.Agent
Kingsoft	Win32.HeurC.KVMH017.a
Microsoft	TrojanDownloader:Win32/Horst.M
Xcitium	TrojWare.Win32.TrojanProxy.Horst.~W@f80rq
Arcabit	Trojan.ExplorerHijack.EFB1C4
ViRobot	Trojan.Win32.A.Downloader.67054
ZoneAlarm	Trojan-Downloader.Win32.Agent.aii
GData	Gen:Trojan.ExplorerHijack.dmX@aC@Jdje
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.C81792
BitDefenderTheta	AI:Packer.EC14F3B41E
ALYac	Gen:Trojan.ExplorerHijack.dmX@aC@Jdje
MAX	malware (ai score=100)
VBA32	TrojanDownloader.Agent
Malwarebytes	Medbot.Backdoor.Bot.DDS
Panda	Trj/Downloader.LSL
Rising	Trojan.DL.Win32.Agent.aii (CLASSIC)
Yandex	Trojan.GenAsa!in7MxuGMcIY
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1265130.susgen
Fortinet	W32/Injector.BVT!tr
AVG	Win32:Agent-EFH [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Trojan[downloader]:Win/Medbot.DF