About “Trojan:Win32/Kwampirs.B!dha” infection

The Trojan:Win32/Kwampirs.B!dha is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Kwampirs.B!dha virus can do?

Authenticode signature is invalid
Anomalous binary characteristics
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Kwampirs.B!dha?


File Info:
name: 3B3A1062689FFA191E58.mlw
path: /opt/CAPEv2/storage/binaries/ea61bcd4774ce2b6ab364a7831f36e010214be2ba2e6daa7dcba10b7e229ddfa
crc32: 52A727FF
md5: 3b3a1062689ffa191e58d5507d39939d
sha1: ce3e75f6f8b187656d18618756da68aac135b334
sha256: ea61bcd4774ce2b6ab364a7831f36e010214be2ba2e6daa7dcba10b7e229ddfa
sha512: 5d0f0e14923b7f09be283e8d2181ee2041e3830622258e8555c77691577501f8bb84d8f468bde98b899d09355cc443ef756b09cd07290660f92c411665c94c6a
ssdeep: 12288:Kfmj3br9MUi2zujFK9NNk55iOW2C2zujFK9NNk55iOW2AQ:KCL2Ui2XNOC2XNOAQ
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T14F5519F20C4D6C91D6FFEDB566494CBE90AE58A8104FCA0192F4C947CB89EDA913835F
sha3_384: dcb2e827a4f075051dd0535e672acb54c4c06c6bf0ddd025e42093989189af143c17d8d9ee2925884dc81c32bbffa5c3
ep_bytes: e868870000e995feffff8bff558bec83
timestamp: 2011-06-17 14:35:44

Version Info:
CompanyName: Indiana Software Foundation
FileDescription: WMI Performance Adapter Service Extension
FileVersion: 5.3.3790.3959 (srv03_sp3_rtm.070216-1710)
InternalName: WmiApSrve.exe
LegalCopyright: © Indiana Software Foundation. All rights reserved.
OriginalFilename: WmiApSrve.exe
ProductName: Indiana Software Foundation® Software Products® Utility Tools
ProductVersion: 5.3.3790.3959
Translation: 0x0409 0x04b0

Trojan:Win32/Kwampirs.B!dha also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Zapchast.trhR
tehtris	Generic.Malware
MicroWorld-eScan	Trojan.Kwampirs.A
CAT-QuickHeal	Trojan.Kwampirs.S55277
Skyhigh	Trojan-FIZW!3B3A1062689F
ALYac	Trojan.Kwampirs.A
Cylance	unsafe
Zillya	Downloader.Zapchast.Win32.3
Sangfor	Downloader.Win32.Kwampirs.Ve13
K7AntiVirus	Trojan ( 004f77071 )
Alibaba	TrojanDownloader:Win32/Zapchast.86eaf4d2
K7GW	Trojan ( 004f77071 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Kwampirs.A
BitDefenderTheta	Gen:NN.ZexaF.36680.qv0@aCJiDkmO
Symantec	Trojan.Kwampirs
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Agent.YEV
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Kwampirs-1
Kaspersky	Trojan-Downloader.Win32.Zapchast.b
BitDefender	Trojan.Kwampirs.A
NANO-Antivirus	Trojan.Win32.Kwampirs.efznlm
Avast	Win32:Evo-gen [Trj]
Tencent	Malware.Win32.Gencirc.10b5edcc
Sophos	Troj/Agent-AUFE
F-Secure	Heuristic.HEUR/AGEN.1311725
VIPRE	Trojan.Kwampirs.A
TrendMicro	TROJ_KWAMPIRS.SMB
Emsisoft	Trojan.Kwampirs.A (B)
Jiangmin	TrojanDownloader.Zapchast.b
Webroot	W32.Trojan.Kwampirs
Varist	W32/Downloader.SI.gen!Eldorado
Avira	HEUR/AGEN.1311725
Antiy-AVL	Trojan[APT]/Win32.Orangeworm
Kingsoft	malware.kb.a.961
Xcitium	Malware@#1lme04b2g88yf
Microsoft	Trojan:Win32/Kwampirs.B!dha
ViRobot	Trojan.Win32.S.Agent.1324544.B
ZoneAlarm	Trojan-Downloader.Win32.Zapchast.b
GData	Win32.Trojan.Kwampirs.A
Google	Detected
AhnLab-V3	Downloader/Win32.Zapchast.C1539128
McAfee	Trojan-FIZW!3B3A1062689F
TACHYON	Trojan-Downloader/W32.Zapchast.1324544
VBA32	BScope.TrojanDownloader.Zapchast
Malwarebytes	Malware.AI.890304754
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_KWAMPIRS.SMB
Rising	Downloader.Zapchast!8.1008 (TFE:5:olaLSW371NM)
Yandex	Trojan.GenAsa!zEyYceVVBJA
Ikarus	Trojan.Win32.Kwampirs
MaxSecure	Trojan.Malware.2238194.susgen
Fortinet	W32/Agent.AUFE!tr
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Kwampirs.B!dha?

Trojan:Win32/Kwampirs.B!dha removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X