About "Trojan:Win32/Occamy.C76" infection

The Trojan:Win32/Occamy.C76 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Occamy.C76 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
Creates RWX memory
Anomalous binary characteristics

Related domains:

boldidiotruss.xyz

nizaoplov.xyz

153ishak.best

How to determine Trojan:Win32/Occamy.C76?


File Info:
crc32: 579430F9
md5: 17091a1e444f306b928d69f2b905bc8b
name: 17091A1E444F306B928D69F2B905BC8B.mlw
sha1: 1078744833050626e9681c7c233c3a0963a0b559
sha256: 76cd290b236b11bd18d81e75e41682208e4c0a5701ce7834a9e289ea9e06eb7e
sha512: 4a62f6a289f06b90d6ca080793cf4ae85e1adca3c2d83c66375ae6458f8ed9d58d7e57649634d7e4a722e7c1f252156883641c822590d38c70d9dbadec6fa29d
ssdeep: 3072:ba8SY43/m5E+dynrtyZkishPxmjQIhWv:ba5Yye5Efnx9hPxmMzv
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Licensed under the GNU GPL, v3.
InternalName: Now Wardoor
FileVersion: 6.8.97.82
CompanyName: Invent Kyriba
ProductName: Now Wardoor
ProductVersion: 6.8.97.82
FileDescription: Now Wardoor
OriginalFilename: Now Wardoor.exe
Translation: 0x0409 0x04b0

Trojan:Win32/Occamy.C76 also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Johnnie.230587
ALYac	Trojan.IcedID.gen
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056340f1 )
BitDefender	Gen:Variant.Johnnie.230587
K7GW	Trojan ( 0056340f1 )
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-Banker.Win32.Cridex.iuq
Alibaba	TrojanBanker:Win32/Cridex.8e9a1ca1
NANO-Antivirus	Trojan.Win32.Cridex.hgufkj
Tencent	Win32.Trojan-banker.Cridex.Dvpx
Ad-Aware	Gen:Variant.Johnnie.230587
F-Secure	Trojan.TR/Redcap.sxmbo
TrendMicro	TROJ_GEN.R066C0WG720
FireEye	Generic.mg.17091a1e444f306b
Sophos	Mal/Generic-S
SentinelOne	DFI – Suspicious PE
Jiangmin	Trojan.Banker.Cridex.agf
Avira	TR/Redcap.sxmbo
MAX	malware (ai score=88)
Antiy-AVL	Trojan[Banker]/Win32.Cridex
Microsoft	Trojan:Win32/Occamy.C76
Arcabit	Trojan.Johnnie.D384BB
ZoneAlarm	Trojan-Banker.Win32.Cridex.iuq
GData	Gen:Variant.Johnnie.230587
Cynet	Malicious (score: 85)
McAfee	Artemis!17091A1E444F
VBA32	TrojanBanker.Cridex
Malwarebytes	Trojan.Dridex
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Generik.FZTLRMJ
TrendMicro-HouseCall	TROJ_GEN.R066C0WG720
Rising	Trojan.Occamy!8.F1CD (CLOUD)
Ikarus	Trojan.SuspectCRC
Fortinet	W32/Generik.FZTLRMJ!tr
Webroot	W32.Trojan.Gen
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/Trojan.ac9

How to remove Trojan:Win32/Occamy.C76?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Trojan:Win32/Occamy.C76” infection