How to remove “Trojan:Win32/Ymacco.AA0A”?

The Trojan:Win32/Ymacco.AA0A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Ymacco.AA0A virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Trojan:Win32/Ymacco.AA0A?


File Info:
crc32: FF08C690
md5: ca6ad7a9ebeb09cce5a3b58cf57ec137
name: RFQ_DN400CCC331G,PDF.exe
sha1: 545546a53aa7d101a41e0c1be3f5e7059df6ed15
sha256: 0a69136aed3f43352db370b595ab42f1de09e7de6cfddfee3248cf4e6b310709
sha512: fa0ffeecc1507e01d567ff876feae2377f9d228f8a68aefd2f687b48570a961d81542a79d64e0b98d2fe13b202aabbd0da54772028573bf063c1aa983abc7111
ssdeep: 49152:WP1ecIpdmKrl9wddiWJ970phP8mOUAK9:WP1ecIpdmKrl9sdiWJ97ohP8mLAK
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation.  All rights reserved.
InternalName: lc.exe
FileVersion: 4.8.3928.0 built by: NET48REL1
CompanyName: Microsoft Corporation
PrivateBuild: DDBLD495
Comments: Flavor=Retail
ProductName: Microsoftxae .NET Framework
ProductVersion: 4.8.3928.0
FileDescription: .NET Framework license compiler
OriginalFilename: lc.exe
Translation: 0x0409 0x04b0

Trojan:Win32/Ymacco.AA0A also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43658890
FireEye	Generic.mg.ca6ad7a9ebeb09cc
McAfee	Artemis!CA6AD7A9EBEB
Cylance	Unsafe
BitDefender	Trojan.GenericKD.43658890
Cybereason	malicious.53aa7d
TrendMicro	TROJ_FRS.VSNTHE20
Symantec	ML.Attribute.HighConfidence
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Injuke.gen
Alibaba	Trojan:MSIL/Injuke.d800338b
AegisLab	Trojan.Multi.Generic.4!c
Rising	Trojan.Injuke!8.10932 (CLOUD)
Ad-Aware	Trojan.GenericKD.43658890
Comodo	.UnclassifiedMalware@0
F-Secure	Trojan.TR/Redcap.cskjp
DrWeb	Trojan.PWS.Siggen2.53579
VIPRE	Trojan.Win32.Generic!BT
Fortinet	PossibleThreat
Sophos	Mal/Generic-S
Ikarus	Trojan.SuspectCRC
MaxSecure	Trojan.Malware.74181957.susgen
Avira	TR/Redcap.cskjp
MAX	malware (ai score=85)
Arcabit	Trojan.Generic.D29A2E8A
ZoneAlarm	HEUR:Trojan.MSIL.Injuke.gen
Microsoft	Trojan:Win32/Ymacco.AA0A
Cynet	Malicious (score: 85)
BitDefenderTheta	Gen:NN.ZemsilF.34152.5o0@aGa8Dbbi
ALYac	Trojan.GenericKD.43658890
Malwarebytes	Trojan.FakeMS
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Generik.DQDUQWM
TrendMicro-HouseCall	TROJ_FRS.VSNTHE20
Tencent	Msil.Trojan.Injuke.Szli
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_97%
GData	Trojan.GenericKD.43658890
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_80% (W)
Qihoo-360	Generic/HEUR/QVM03.0.3805.Malware.Gen

How to remove Trojan:Win32/Ymacco.AA0A?

Trojan:Win32/Ymacco.AA0A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X