Categories: Trojan

TrojanDownloader:Win32/Raykmerd.A removal

The TrojanDownloader:Win32/Raykmerd.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Raykmerd.A virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (3 unique times)
Creates RWX memory
Performs some HTTP requests
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Creates a hidden or system file
Attempts to modify proxy settings

Related domains:

base.qzone.qq.com

blog.sina.com.cn

deng.qiniudn.com

software2004.blog.163.com

blog.163.com

www.bing.com

b.bst.126.net

How to determine TrojanDownloader:Win32/Raykmerd.A?


File Info:
crc32: 1D7ACBC3md5: 8d1dca3fed512dd1d905eb63045f8d10name: 8D1DCA3FED512DD1D905EB63045F8D10.mlwsha1: c1e67858d26e5f7389911b389348bcf213e49c0csha256: 707bf9cde30884a8e038596f93568a3f3f2dfce90a400ccb43780c9f88438e08sha512: d7b274844d32b3071832044588a32c3931f290e4a0e97786290ebf99b73104f4a5f9a1fb198f3a1cb615afbb7b3f74b2e05ed13d970e92c1ba6790e7505d690bssdeep: 3072:RXvFHmryUmlEdAmAoQ5iJeyUUGyuFoFHDS9fqUeQictNJKI3SdBWdWZ:RdHm+llEdAm/0iJUUgf5ijCzYtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

TrojanDownloader:Win32/Raykmerd.A also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Strictor.57962
FireEye	Generic.mg.8d1dca3fed512dd1
CAT-QuickHeal	Hacktool.Flystudio.16558
McAfee	GenericR-CUI!8D1DCA3FED51
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Badur.lZKm
Sangfor	Malware
K7AntiVirus	Trojan-Downloader ( 0055e3da1 )
BitDefender	Gen:Variant.Strictor.57962
K7GW	Trojan-Downloader ( 0055e3da1 )
CrowdStrike	win/malicious_confidence_100% (D)
Baidu	Win32.Trojan-Downloader.Agent.br
Cyren	W32/A-cf2e9719!Eldorado
Symantec	ML.Attribute.HighConfidence
TotalDefense	Win32/Tnega.GHHKGOC
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Trojan.Agent-1374788
Kaspersky	Trojan-Downloader.Win32.Agent.xxyyqf
Alibaba	TrojanDownloader:Win32/Raykmerd.5e4c0bf8
NANO-Antivirus	Trojan.Win32.Badur.cztixt
Rising	Trojan.Generic@ML.94 (RDMK:GynH+es9C9ZWTS79CcyL7w)
Ad-Aware	Gen:Variant.Strictor.57962
TACHYON	Trojan/W32.Badur.258048
Emsisoft	Gen:Variant.Strictor.57962 (B)
Comodo	TrojWare.Win32.TrojanDownloader.Raykmerd.QP@5pw47m
F-Secure	Heuristic.HEUR/AGEN.1120050
DrWeb	Trojan.Badur.48
TrendMicro	TROJ_FRS.0NA103CM20
McAfee-GW-Edition	BehavesLike.Win32.Generic.dh
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Badur.cuh
Webroot	W32.Badur.hsua
Avira	HEUR/AGEN.1120050
Antiy-AVL	Trojan/Win32.Badur
Microsoft	TrojanDownloader:Win32/Raykmerd.A
Arcabit	Trojan.Strictor.DE26A
SUPERAntiSpyware	Trojan.Agent/Gen-Raykmerd
ZoneAlarm	Trojan-Downloader.Win32.Agent.xxyyqf
GData	Gen:Variant.Strictor.57962
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.R112118
BitDefenderTheta	Gen:NN.ZexaF.34760.pqW@ai8zESjb
ALYac	Gen:Variant.Strictor.57962
MAX	malware (ai score=100)
VBA32	BScope.Backdoor.BlackHole
Cylance	Unsafe
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/TrojanDownloader.Raykmerd.A
TrendMicro-HouseCall	TROJ_FRS.0NA103CM20
Tencent	Malware.Win32.Gencirc.10b58cb8
Yandex	Trojan.Badur!wPYBTqwrJGw
Ikarus	Trojan.SuspectCRC
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/GenKryptik.ESFJ!tr
AVG	Win32:Malware-gen
Cybereason	malicious.fed512
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.95c