Trojan

How to remove “Trojan:Win32/InstallCore”?

Malware Removal

The Trojan:Win32/InstallCore is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan:Win32/InstallCore virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Uses Windows utilities for basic functionality
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Network activity detected but not expressed in API logs

How to determine Trojan:Win32/InstallCore?


File Info:

crc32: 48E0E844
md5: c330f056fdf33d5af984355442be3e5b
name: C330F056FDF33D5AF984355442BE3E5B.mlw
sha1: cb7a61901530599a4ac68e5fa785da79f36d3e4d
sha256: 75e0f92d86d2e3e452cc015bdedfdc7d636d5a8380928ce2e89d6a2e8d38d6d8
sha512: a794071ebab65983797c14c8a6bbb8f8792a8d6c1cc9eeb91a08c6ab4f28379679b6f9dc1962205f67a5887bc69d24fa9a18a5eb26d31564712b9546ce0d6061
ssdeep: 24576:vXx7lI7EIzRkCWGk1dzXTronDqpOfLvQN3I6GTp7PaISIv01ebJ47Auh41TS4lU:vXU7EIzRk7HdbTrKqpGcNxGTZPaBsbB
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Trojan:Win32/InstallCore also known as:

Elasticmalicious (high confidence)
ClamAVWin.Trojan.Generic-9781594-0
FireEyeGeneric.mg.c330f056fdf33d5a
CAT-QuickHealTrojan.Injuke
McAfeeGenericRXAA-AA!C330F056FDF3
CylanceUnsafe
AegisLabTrojan.Win32.Injuke.4!c
SangforMalware
CrowdStrikewin/malicious_confidence_80% (D)
BitDefenderGen:Variant.Barys.74413
K7GWTrojan ( 005511781 )
K7AntiVirusTrojan ( 005511781 )
CyrenW32/DealPly.BR.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin64:Malware-gen
CynetMalicious (score: 100)
KasperskyTrojan.Win32.Injuke.doew
AlibabaTrojan:Win32/DealPly.1dd
NANO-AntivirusRiskware.Win32.DealPly.huqkvj
ViRobotTrojan.Win32.Z.Roxer.1544192.AIS
MicroWorld-eScanGen:Variant.Barys.74413
RisingStealer.Agent!8.C2 (CLOUD)
Ad-AwareGen:Variant.Barys.74413
SophosMal/Generic-R
ComodoMalware@#1jy88i1xlri85
F-SecureHeuristic.HEUR/AGEN.1139727
DrWebTrojan.DownLoader34.63236
TrendMicroTROJ_GEN.R004C0DB221
McAfee-GW-EditionBehavesLike.Win32.Generic.tc
EmsisoftApplication.Generic (A)
IkarusTrojan.Win32.Agent
JiangminTrojanDropper.Roxer.e
AviraHEUR/AGEN.1139727
MAXmalware (ai score=84)
Antiy-AVLTrojan/Win32.Agent
MicrosoftTrojan:Win32/InstallCore
GridinsoftTrojan.Win32.Downloader.oa
ArcabitTrojan.Barys.D122AD
ZoneAlarmTrojan.Win32.Injuke.doew
GDataWin32.Trojan.Agent.AQI
AhnLab-V3Malware/Win32.Generic.C3152050
ALYacGen:Variant.Barys.74413
VBA32BScope.TrojanDropper.Roxer
MalwarebytesTrojan.MalPack
PandaTrj/GdSda.A
ESET-NOD32multiple detections
TrendMicro-HouseCallTROJ_GEN.R004C0DB221
TencentWin32.Trojan.Injuke.Svqm
YandexTrojan.GenAsa!VJkolMvBCP8
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/GenKryptik.CMPB!tr
AVGWin64:Malware-gen
Cybereasonmalicious.6fdf33
Qihoo-360Win32/Adware.InstallCore.HwsBCc0A

How to remove Trojan:Win32/InstallCore?

Trojan:Win32/InstallCore removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment