Trojan

Trojan:Win32/Nebuler.Q (file analysis)

Malware Removal

The Trojan:Win32/Nebuler.Q is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:Win32/Nebuler.Q virus can do?

  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Attempts to modify proxy settings
  • Deletes executed files from disk
  • Harvests cookies for information gathering
  • Unusual version info supplied for binary
  • Uses suspicious command line tools or Windows utilities

How to determine Trojan:Win32/Nebuler.Q?



File Info:

name: 7842FB49D6AD42448E92.mlw
path: /opt/CAPEv2/storage/binaries/c8443955d313d4745a7e67224dfbe2bf6f12b7c818439d375cda392a75dee62d
crc32: 43A08FDA
md5: 7842fb49d6ad42448e92432e79233707
sha1: 3cef748e0892bb18a1eda0c452786137eafa6029
sha256: c8443955d313d4745a7e67224dfbe2bf6f12b7c818439d375cda392a75dee62d
sha512: 9448683b1636d7aeb8d370743c26dc4cc732491f9b3f2f0cb7631a200402140092db0867541cb926a95b8ce5a16aa72f783878791a1b1c6b871423f5ef01eca7
ssdeep: 1536:Ab/JqKmdYxBayUdgMpc61TvRLR1B5FpFQwPUXHblf/j3Da7y/fLe:ANEdiUyUpRvRbfFDQ+U3blfL+7eLe
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T191B3D011F1C89949E4AA80765EFE6786F532ED38835141CB6FE01D366DA06D3BC39A83
sha3_384: e1deac5dc333129a4e508b8000ecccb459e867ece02a84384db4cb166ff131cfe53d3cf16b17348199066c0df29ab5ba
ep_bytes: e87a040000e957fdffffff2504724000
timestamp: 2010-12-04 00:04:53


Version Info:

CompanyName: Windows (R) Codename Longhorn DDK provider
FileDescription: Clock Applet
FileVersion: 6.0.6000.16384
InternalName: clock
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: CLOCK.EXE
ProductName: Windows (R) Codename Longhorn DDK driver
ProductVersion: 6.0.6000.16384
Translation: 0x0409 0x04b0

Trojan:Win32/Nebuler.Q also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.ImgDrop.a!c
MicroWorld-eScanGen:Trojan.ExplorerHijack.gq0@aqdqsUpi
FireEyeGeneric.mg.7842fb49d6ad4244
ALYacGen:Trojan.ExplorerHijack.gq0@aqdqsUpi
MalwarebytesMalware.AI.3009408762
ZillyaDownloader.ImgDrop.Win32.1238
SangforSuspicious.Win32.Save.ins
K7AntiVirusHacktool ( 0052858e1 )
AlibabaTrojan:Win32/Nebuler.27e367e0
K7GWHacktool ( 0052858e1 )
CrowdStrikewin/malicious_confidence_90% (D)
BitDefenderThetaGen:NN.ZexaF.36250.gq0@aqdqsUpi
CyrenW32/Nebuler.E.gen!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Nebuler.BR
APEXMalicious
ClamAVWin.Trojan.Nebuler-9446495-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Trojan.ExplorerHijack.gq0@aqdqsUpi
NANO-AntivirusTrojan.Win32.ImgDrop.dtzet
SUPERAntiSpywareTrojan.Agent/Gen-Nebuler
AvastWin32:Dropper-FFH [Drp]
TencentWin32.Trojan.Generic.Czlw
EmsisoftGen:Trojan.ExplorerHijack.gq0@aqdqsUpi (B)
F-SecureTrojan.TR/Nebuler.MA.2
VIPREGen:Trojan.ExplorerHijack.gq0@aqdqsUpi
TrendMicroTROJ_NEBULER.SMT
McAfee-GW-EditionArtemis!Trojan
Trapminemalicious.high.ml.score
SophosMal/TDSSPk-AE
GDataGen:Trojan.ExplorerHijack.gq0@aqdqsUpi
JiangminTrojanDownloader.ImgDrop.ui
WebrootW32.Nebuler.Gen
GoogleDetected
AviraTR/Nebuler.MA.2
Antiy-AVLTrojan/Win32.AGeneric
XcitiumMalware@#2v2nj8nfkfc6m
ArcabitTrojan.ExplorerHijack.ED11B4E
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftTrojan:Win32/Nebuler.Q
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Nebuler.R6366
McAfeeArtemis!7842FB49D6AD
MAXmalware (ai score=100)
VBA32Trojan.Paramis
Cylanceunsafe
PandaTrj/Genetic.gen
TrendMicro-HouseCallTROJ_NEBULER.SMT
RisingTrojan.Nebuler!8.8E0 (TFE:5:6AczuBp9huE)
IkarusTrojan.Win32.Nebuler
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Nebuler.P!tr
AVGWin32:Dropper-FFH [Drp]
Cybereasonmalicious.9d6ad4
DeepInstinctMALICIOUS

How to remove Trojan:Win32/Nebuler.Q?

Trojan:Win32/Nebuler.Q removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment