Trojan:Win32/Vundo!AV (file analysis)

The Trojan:Win32/Vundo!AV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Vundo!AV virus can do?

Behavioural detection: Executable code extraction – unpacking
CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine Trojan:Win32/Vundo!AV?


File Info:
name: A11CA28FD9ECEE2C5E9C.mlw
path: /opt/CAPEv2/storage/binaries/bfb9ed18f7d42b9e50b0524123d79d7d55580dddabc5473da31f682d9df25e87
crc32: 29C54FBB
md5: a11ca28fd9ecee2c5e9ccc2eb45092c8
sha1: fa25a4a770e0144ab07bd883357798c910972740
sha256: bfb9ed18f7d42b9e50b0524123d79d7d55580dddabc5473da31f682d9df25e87
sha512: aaa4fc3323ab6b7835f7f62c96c6ee737639e3ea1715a785e11ea7b34484b5267c30130e482bbf67d246d1d833e5f524466151fed4107952554dd43f48682ed1
ssdeep: 3072:q68A8Me7T/nYzjKUgSVORTN1hCXn1wMwHyaXnTcRJGwPwdplrxtnIPRZZPkL:q6mMe7GjvVfwMwpwYR3I1
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T188E39E43FA83C075CAAF28B6503BDD7748B51F52CE256A07EFC45DAE21269B0C236716
sha3_384: 90b286cce98c90877f620253e7e23d03ce79860867e540f29d8a21e129041ce256ac0936d5c9052991475dba51d242f0
ep_bytes: 558bec538b5d08568b750c578b7d1085
timestamp: 2007-02-26 04:57:15

Version Info:
CompanyName: Sqdxuwjyv Jtzvdxwxyfz
FileDescription: RD Gateway QEC
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
InternalName: tsgqec.dll
LegalCopyright: © Pfsomcmvl Jfkoqfylawb. All rights reserved.
OriginalFilename: tsgqec.dll
ProductName: Qidllkosj® Windows® Mphwnomth Jumiqu
ProductVersion: 6.1.7600.16385
Translation: 0x0409 0x04b0

Trojan:Win32/Vundo!AV also known as:

Bkav	W32.Common.7589E551
Lionic	Trojan.Win32.Vundo.4!c
tehtris	Generic.Malware
DrWeb	Trojan.WinSpy.1313
MicroWorld-eScan	Gen:Heur.Ranpax.1
FireEye	Generic.mg.a11ca28fd9ecee2c
Skyhigh	Vundo.gen.fy
McAfee	Vundo.gen.fy
Cylance	unsafe
VIPRE	Gen:Heur.Ranpax.1
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/Kryptik.cdf2793e
K7GW	Trojan ( 004908121 )
K7AntiVirus	Trojan ( 004908121 )
BitDefenderTheta	Gen:NN.ZedlaF.36802.ju8@auiifwpi
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.GND
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.Win32.Generic
BitDefender	Gen:Heur.Ranpax.1
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
SUPERAntiSpyware	Trojan.Agent/Gen-Falcomp[Cont]
Avast	Win32:GenMalicious-SQ [Trj]
Emsisoft	Gen:Heur.Ranpax.1 (B)
F-Secure	Trojan.TR/ATRAPS.Gen4
Zillya	Trojan.Kryptik.Win32.142998
TrendMicro	TROJ_GEN.R002C0OBJ24
Sophos	Troj/Virtum-Gen
Ikarus	Trojan.Win32.Pirminay
Jiangmin	Trojan/Generic.fyyl
Google	Detected
Avira	TR/ATRAPS.Gen4
Antiy-AVL	Trojan/Win32.Kryptik
Kingsoft	malware.kb.a.1000
Microsoft	Trojan:Win32/Vundo.gen!AV
Xcitium	Malware@#3s6xkd11jj5e5
Arcabit	Trojan.Ranpax.1
GData	Gen:Heur.Ranpax.1
Varist	W32/Virtumonde.CH.gen!Eldorado
VBA32	BScope.Trojan.WinSpy
MAX	malware (ai score=100)
Malwarebytes	Malware.AI.4059080698
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_GEN.R002C0OBJ24
Rising	Trojan.Vundo!8.4FC (TFE:5:I5fx32SAIe)
Yandex	Trojan.Kryptik!/gqpJtBNQNU
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.2588.susgen
Fortinet	W32/Kryptik.ANL!tr
AVG	Win32:GenMalicious-SQ [Trj]
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Vundo!AV?

Trojan:Win32/Vundo!AV removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X