Categories: Trojan

Trojan:Win32/Killav.AO malicious file

The Trojan:Win32/Killav.AO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Killav.AO virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Attempts to connect to a dead IP:Port (1 unique times)
Possible date expiration check, exits too soon after checking local time
Loads a driver
Dynamic (imported) function loading detected
Enumerates running processes
A process created a hidden window
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Installs itself for autorun at Windows startup
Installs itself for autorun at Windows startup

How to determine Trojan:Win32/Killav.AO?


File Info:
name: 7EA70E22EC5EDDC9BE85.mlwpath: /opt/CAPEv2/storage/binaries/062456dee20994c84fcbc481de8f9c1be3d690555e7dad5848f6a3b2361897a6crc32: 0B29CB2Amd5: 7ea70e22ec5eddc9be85013a97eefc32sha1: e56592ae0855d4d3d1b9aa9d3e93f1ff03e63840sha256: 062456dee20994c84fcbc481de8f9c1be3d690555e7dad5848f6a3b2361897a6sha512: 56cbad6774f67edf8c72793e79e90732a61ed9a342f16ce5a79e5ce78aee99aca6d52d08247a1a0eb345ce2d623a4e26af14296183e7bb14880d4512d10cea25ssdeep: 384:7lxDWRkl6rYEw9vfGAtr7JI9h2nvRc0cJYz5vd0VCIpHJo8YFGqP5vXWvwWy:DyRY6nw9vfGAtrVW85c0cJudYCIp9YFItype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T165A24C9277905C63CCE5433181632B165BBBBC30263A18EBCBD5564D2CA69E2FD36313sha3_384: 423bd0d05198d8ccc664f32dff9ba8ec2a5071935867f20551719ee78f9d06d4a23af3da141071baa74b11dcb7eb08c9ep_bytes: 558bec81ec6001000053565733f65656timestamp: 2009-02-11 13:32:40
Version Info:
0: [No Data]

Trojan:Win32/Killav.AO also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.KillAV.PZ
FireEye	Generic.mg.7ea70e22ec5eddc9
CAT-QuickHeal	Trojan.Skeeyah.11061
ALYac	Trojan.KillAV.PZ
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.2ec5ed
Cyren	W32/Trojan.PLLB-7775
Symantec	Trojan.Dropper
ESET-NOD32	Win32/Agent.OVS
APEX	Malicious
ClamAV	Win.Trojan.Agent-524036
Kaspersky	Trojan-Dropper.Win32.Small.edr
BitDefender	Trojan.KillAV.PZ
NANO-Antivirus	Trojan.Win32.Small.cujklo
Avast	Win32:Trojan-gen
Rising	Trojan.DL.Win32.Nodef.oc (CLASSIC)
Ad-Aware	Trojan.KillAV.PZ
TACHYON	Trojan/W32.KillAV.23040
Emsisoft	Trojan.KillAV.PZ (B)
Comodo	TrojWare.Win32.Trojan.KillAV.~CJ@2nb0r
DrWeb	Trojan.MulDrop3.11549
TrendMicro	RTKT_AVKILL.SM
McAfee-GW-Edition	Generic Dropper.ft
Sophos	ML/PE-A + Mal/Behav-112
SentinelOne	Static AI – Malicious PE
GData	Trojan.KillAV.PZ
Jiangmin	Trojan/KillAV.yt
Avira	TR/Reno.A.1
Antiy-AVL	Trojan/Generic.ASMalwS.8172D
Kingsoft	Heur.SSC.2762994.0010.(kcloud)
Arcabit	Trojan.KillAV.PZ
ViRobot	Trojan.Win32.KillAV.23040.B
Microsoft	Trojan:Win32/Killav.AO
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.KillAV.R13955
McAfee	Generic Dropper.ft
MAX	malware (ai score=82)
VBA32	BScope.Trojan.Corpse
Malwarebytes	Malware.AI.1099498299
TrendMicro-HouseCall	RTKT_AVKILL.SM
Tencent	Malware.Win32.Gencirc.10b3aac0
Yandex	Trojan.GenAsa!MIc3O4KUa2E
Ikarus	Trojan.Win32.KillAV
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Generic.AC.2511E4!tr
BitDefenderTheta	AI:Packer.33D98AAC1F
AVG	Win32:Trojan-gen
Panda	Generic Malware
CrowdStrike	win/malicious_confidence_90% (D)