Categories: Trojan

TrojanDownloader:Win32/Kilim.D removal instruction

The TrojanDownloader:Win32/Kilim.D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Kilim.D virus can do?

Performs HTTP requests potentially not found in PCAP.
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Attempts to repeatedly call a single API many times in order to delay analysis time
Attempts to modify proxy settings
Harvests cookies for information gathering
Attempts to modify UAC prompt behavior
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine TrojanDownloader:Win32/Kilim.D?


File Info:
name: B0BEBF0021BB357D51CD.mlwpath: /opt/CAPEv2/storage/binaries/0840923a5308e3a89ef7234da1698cfacb0caaa4ab5487312e82e7c892a1182ecrc32: E1D7C1D0md5: b0bebf0021bb357d51cdf90940dcfa92sha1: 5be472bf225edb35bfc8c4bf55f8effd870a9a08sha256: 0840923a5308e3a89ef7234da1698cfacb0caaa4ab5487312e82e7c892a1182esha512: d2f658c145f0961c23e23aee2cb9c1a0cdddde6cad3476ef73f701eb7527a918807e5bd5ec6acb093f3e0be29c6779d35f91190f2e480171cce5a24eb322fbe1ssdeep: 6144:I+ssXv5jUA2OpjesAOfoTb+v+90TveVBciZnbCUxP4C9tgf/AN1LtdReCBJJKKrb:COv5jKhsfoPA+yeVKUCUxP4C902bdRtntype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1517423A0B46C8C96FAA0353551FD9F771A2DDF624C1A4BCC2EC5EC9274B3A611AC163Csha3_384: 08a22ae4887c4d219d57e9c493ec246e09eebb18568678f02559feb70252a32aa3ae0a8aef822f8d6e66ce18c3d8b951ep_bytes: 60be00c048008dbe0050f7ff57eb0b90timestamp: 2014-12-27 02:00:13
Version Info:
Translation: 0x0809 0x04b0

TrojanDownloader:Win32/Kilim.D also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (moderate confidence)
DrWeb	Trojan.Click3.10273
MicroWorld-eScan	AIT:Trojan.Nymeria.4469
FireEye	AIT:Trojan.Nymeria.4469
CAT-QuickHeal	Trojan.AutoIT.Kilim.Z
McAfee	Artemis!B0BEBF0021BB
Malwarebytes	Malware.AI.1157032947
Sangfor	Riskware.Win32.Agent.ky
K7AntiVirus	Trojan-Downloader ( 004e58141 )
Alibaba	TrojanDownloader:Win32/Kilim.f866adea
K7GW	Trojan-Downloader ( 004e58141 )
Cybereason	malicious.021bb3
Cyren	W32/Downloader.HH.gen!Eldorado
Symantec	Trojan.Gen.MBT
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/TrojanDownloader.Autoit.NWO
APEX	Malicious
ClamAV	Win.Malware.Autoit-9888455-0
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	AIT:Trojan.Nymeria.4469
NANO-Antivirus	Trojan.Win32.Click3.fgxvko
Avast	Win32:Rootkit-gen [Rtk]
Tencent	Win32.Trojan.Agen.Szfl
Emsisoft	AIT:Trojan.Nymeria.4469 (B)
F-Secure	Heuristic.HEUR/AGEN.1358061
VIPRE	AIT:Trojan.Nymeria.4469
McAfee-GW-Edition	BehavesLike.Win32.Injector.fc
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
GData	Gen:Variant.Strictor.71792
Webroot	W32.Rogue.Gen
Google	Detected
Avira	HEUR/AGEN.1358061
Xcitium	Malware@#18ghitp2hxuqk
Arcabit	AIT:Trojan.Nymeria.D1175 [many]
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	TrojanDownloader:Win32/Kilim.D
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Spnr.C589821
VBA32	Trojan-Downloader.Autoit.gen
ALYac	AIT:Trojan.Nymeria.4469
MAX	malware (ai score=100)
Cylance	unsafe
Panda	Trj/CI.A
Rising	Trojan.Generic@AI.96 (RDML:mSQIFeKL/MTZh9qKpeRs+g)
Ikarus	Trojan-Downloader.Win32.AutoIt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Autoit.NXB!tr.dldr
AVG	Win32:Rootkit-gen [Rtk]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_60% (W)