Should I remove “Trojan:Win32/Ymacco.AB1C”?

The Trojan:Win32/Ymacco.AB1C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Ymacco.AB1C virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Created a process from a suspicious location
• Checks the version of Bios, possibly for anti-virtualization
• Detects VirtualBox through the presence of a registry key
• Anomalous binary characteristics

How to determine Trojan:Win32/Ymacco.AB1C?

File Info:
name: F30D7DF1A6181CB40960.mlw
path: /opt/CAPEv2/storage/binaries/1c27ca051dae44a935cc7d0d73b58fee074e5f1f1cf7ca901a4c47b348ac9a31
crc32: 46854D41
md5: f30d7df1a6181cb409607da761e55afa
sha1: bd39a99b00c68a6c438e9edc7c2041be4a4331c3
sha256: 1c27ca051dae44a935cc7d0d73b58fee074e5f1f1cf7ca901a4c47b348ac9a31
sha512: 3001fbbc8414764fed326f1f5c4df5bc68ccbef17e41659b18af5c40b6e7e4cba659488cea5697551ae8244bf42c13112b3623b7593fe09429daf02008ca7163
ssdeep: 98304:xFBW//Vh5lJBSw5Yn2aB55ycN9ROY79CjcOU8NADddaDs6WFmfH9iJmbp9P28DVQ:o3tlLYxBfAY7cjrB1WZ69P28Dm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AF4633F197E13871D1231071F06CA2797BE6BE0E8EB058A7FB1BE51936308D152A9B53
sha3_384: 7e2bd0054cceee6b17931399864a2777de7a2a9a7f2c750bf2f09e7cbbc2213b2b586deb75445caad432b03ee0709ae7
ep_bytes: e885630000e978feffff8bff558bec56
timestamp: 2015-02-15 08:00:31

Version Info:
FileDescription: Unhitching Unstifling
InternalName: Tabetiform
OriginalFilename: Semidouble
CompanyName: Arminianism Windermost
LegalCopyright: Copyright (C) 2000-2021 Bicentrically
ProductName: Spirituelle Whitleyville
FileVersion: 4.1.9.7
ProductVersion: 4.1.9.7
Comments: Suppleness
LegalTrademarks: Heuristics Anepigraphic
Title: Selfcorrection Sneedville
Assembly Version: 4.1.9.7
Translation: 0x0409 0x04b0

Trojan:Win32/Ymacco.AB1C also known as:

How to remove Trojan:Win32/Ymacco.AB1C?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.