Categories: Trojan

TrojanProxy:Win32/Pramro.C removal instruction

The TrojanProxy:Win32/Pramro.C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanProxy:Win32/Pramro.C virus can do?

HTTPS urls from behavior.
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Attempts to modify proxy settings
Operates on local firewall’s policies and settings
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine TrojanProxy:Win32/Pramro.C?


File Info:
name: 4A719B328BFBCA567F29.mlwpath: /opt/CAPEv2/storage/binaries/2b1e0b9a7e306ea5ed059c770742bddc7ec21fb63756376c7f6277b1a1f5f2b6crc32: 621BC078md5: 4a719b328bfbca567f29f49784f6159dsha1: 29161890fe4ddab8e2c75885ed3daf337d138b71sha256: 2b1e0b9a7e306ea5ed059c770742bddc7ec21fb63756376c7f6277b1a1f5f2b6sha512: fde4d0d6c84c6503d3b1f4e718f5578a44824d083a8955d150df5b68c264d09928b6a9110c0d52ff1daa6c0e914d20ddfcc4da4e99a5a971c024586ca7334b5fssdeep: 192:fYu0yLpECClBGYh0LEZrN8VkNLeegkCLnXbAu0oimUMIiZ2g:fYudLplC2Yh04ZrN8VkNKeHCLLAZoxXtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1BA32BFAFD739CC83C9400138249E9D1092A56D92A6EB85D1217ED6F73A4B334A685F1Dsha3_384: 45cf9fa660dc0a1a0586a71b24f9bdc9abfdd106e160d654a30313e8befd9368699581fd57f3c27718a843272549b943ep_bytes: 60be008040008dbe0090ffff5783cdfftimestamp: 2009-03-30 10:58:01
Version Info:
0: [No Data]

TrojanProxy:Win32/Pramro.C also known as:

Bkav	W32.AIDetectMalware
Lionic	Virus.Win32.Generic.kZUA
MicroWorld-eScan	Generic.Malware.FYd!dld!.EE75B046
FireEye	Generic.mg.4a719b328bfbca56
Skyhigh	BehavesLike.Win32.Backdoor.lc
McAfee	Spam-Mailbot.n
Malwarebytes	Generic.Malware/Suspicious
VIPRE	Generic.Malware.FYd!dld!.EE75B046
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0040f8b51 )
BitDefender	Generic.Malware.FYd!dld!.EE75B046
K7GW	Trojan ( 0040f8b51 )
Cybereason	malicious.0fe4dd
BitDefenderTheta	AI:Packer.21F0D3CC1E
VirIT	Trojan.Win32.Agent.BQBT
Symantec	Backdoor.Trojan
Elastic	malicious (moderate confidence)
ESET-NOD32	Win32/Agent.HLU
APEX	Malicious
ClamAV	Win.Downloader.69585-1
Kaspersky	Trojan-Mailfinder.Win32.Agent.acn
Alibaba	Trojan:Win32/Pramro.5cfc765b
NANO-Antivirus	Trojan.Win32.Agent.enxlib
ViRobot	Spyware.Agent.Do.11264.AA
Rising	Trojan.Agent!8.B1E (TFE:5:TMlXjKxcH8L)
Sophos	Mal/TinyDL-T
Baidu	Win32.Trojan.Agent.aby
F-Secure	Backdoor.BDS/Backdoor.Gen
DrWeb	Trojan.DownLoad1.5719
Zillya	Trojan.Generic.Win32.100859
TrendMicro	TROJ_PRAMRO.SMI
Trapmine	malicious.high.ml.score
Emsisoft	Generic.Malware.FYd!dld!.EE75B046 (B)
Ikarus	Virus.Win32.Sality
Jiangmin	TrojanDownloader.Agent.bgpn
Webroot	W32.Trojan.Gen
Google	Detected
Avira	BDS/Backdoor.Gen
Varist	W32/Risk.RNCV-8548
Antiy-AVL	Trojan[Mailfinder]/Win32.Agent
Kingsoft	malware.kb.b.998
Microsoft	TrojanProxy:Win32/Pramro.C
Xcitium	TrojWare.Win32.Downloader.Agent.bqbt@2ob3on
Arcabit	Generic.Malware.FYd!dld!.EE75B046
ZoneAlarm	Trojan-Mailfinder.Win32.Agent.acn
GData	Generic.Malware.FYd!dld!.EE75B046
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.CSon.R2002
ALYac	Generic.Malware.FYd!dld!.EE75B046
DeepInstinct	MALICIOUS
VBA32	BScope.TrojanProxy.Agent
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_PRAMRO.SMI
Tencent	Malware.Win32.Gencirc.13c18c31
Yandex	Trojan.GenAsa!uwYIPPXxrhU
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.951740.susgen
Fortinet	W32/Agent.BQBT!tr.dldr
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_100% (W)