TrojanDwnldr.Cutwail.BF5 information

The TrojanDwnldr.Cutwail.BF5 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDwnldr.Cutwail.BF5 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Macau)
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Checks for the presence of known windows from debuggers and forensic tools
• Attempts to identify installed analysis tools by registry key
• Detects VirtualBox through the presence of a registry key
• Emumerates physical drives
• Attempts to modify proxy settings
• Creates a copy of itself
• Collects information to fingerprint the system
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine TrojanDwnldr.Cutwail.BF5?

File Info:
name: C8D9246C08FB0FBD0DBB.mlw
path: /opt/CAPEv2/storage/binaries/f33f8a5605d3f7d157939c35bf2a6b5f0d038430989e6e1e2995fd6d4f79fb6d
crc32: 036DB2D2
md5: c8d9246c08fb0fbd0dbbe06cd6cdca33
sha1: dfb0ba961a3044f819a6a65daaea8b0e79c232ad
sha256: f33f8a5605d3f7d157939c35bf2a6b5f0d038430989e6e1e2995fd6d4f79fb6d
sha512: fdce375a2db84512cbf069ad9641dae87a87340634bf9613f1f5c7a469b2cc390c4c0c04863a9e89e62ac54b4707777fc89f3b13d533dcd2282ccff9a6e45112
ssdeep: 6144:fp4sxG6gFgOvKpcX2iR/spvTKz7M87W6bxjbwwD5iZcPm9hLJqHzh0+dcb91oQiA:fKsJgKc9zjx3rD5iUmTwHKpkQ21
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T191D4E5A82F1493F7C8754EF7CBB97BFDF7E621A25C090A69D092E149961B903050728F
sha3_384: eec334236c8a9a8559e2d8da60476bfe7262752044c347e761a52f424e5cd685018df3e8f88401ef2eb3cd64ee0dc2f5
ep_bytes: 558bec83ec2857c745fc0000000068c0
timestamp: 2015-01-17 23:41:37

Version Info:
CompanyName: Chun Sejin
FileDescription: Image & Animation Viewer
FileVersion: 1.0.8
InternalName: Imagine
LegalCopyright: Copyright (c) 2003-2010 Chun Sejin
Translation: 0x0000 0x04b0

TrojanDwnldr.Cutwail.BF5 also known as:

How to remove TrojanDwnldr.Cutwail.BF5?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.