Categories: Trojan

Trojan:Win32/Ymacco.AB75 removal tips

The Trojan:Win32/Ymacco.AB75 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Ymacco.AB75 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Sniffs keystrokes
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

ms60tzel1.hopto.org

ms60tzel1.ddns.net

How to determine Trojan:Win32/Ymacco.AB75?


File Info:
crc32: 152095A4md5: 4e8209cf66bd6682ad34310ff637faa7name: 4E8209CF66BD6682AD34310FF637FAA7.mlwsha1: 6a1d042abe07796c6f7b861d31bab3a3b491c8c6sha256: 758eb853faa1eac3b6c524e03d23f816f0d10155dee4090b8fba05c5e8dc5713sha512: a061ad8d736e7dc14f7bc9421d39e56ceb52d139b328a727615d97a54a96a8d724e0fb4b21b63214a334f53336d706421b1555c9bb636d48694da2a4f070e411ssdeep: 12288:pYFy5AaLUvoFfMVo8Ie/9Tt6UWU65ffjOcw5RWgrlGiNu6v7l/0IeB:pY3XosXtc51NLOcw50Aldu6vxcHBtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Trojan:Win32/Ymacco.AB75 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	AIT:Trojan.Nymeria.4398
FireEye	Generic.mg.4e8209cf66bd6682
CAT-QuickHeal	Trojan.Script
McAfee	RDN/Generic.cf
Cylance	Unsafe
AegisLab	Trojan.Script.AutoIt.4!c
Sangfor	Malware
BitDefender	AIT:Trojan.Nymeria.4398
K7GW	Trojan ( 00576fa11 )
Cybereason	malicious.abe077
Cyren	VBS/Kryptik.F
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Injector.Autoit.FLR
APEX	Malicious
Avast	Script:SNH-gen [Trj]
Kaspersky	Trojan.Script.AutoIt.d
Alibaba	Trojan:Win32/Injector.db915e6a
ViRobot	Trojan.Win32.Z.Autoit.804115
Tencent	Win32.Trojan.Injuke.Pgde
Ad-Aware	AIT:Trojan.Nymeria.4398
Emsisoft	AIT:Trojan.Nymeria.4398 (B)
Comodo	Malware@#3vlitfec0hjhk
F-Secure	Trojan.TR/AD.Remcos.tugne
DrWeb	Trojan.AutoIt.1002
McAfee-GW-Edition	BehavesLike.Win32.Generic.bc
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Avira	TR/AD.Remcos.tugne
Antiy-AVL	Trojan[Spy]/MSIL.Agent
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Ymacco.AB75
Gridinsoft	Trojan.Win32.Downloader.oa!s1
Arcabit	AIT:Trojan.Nymeria.D112E
ZoneAlarm	HEUR:Trojan.Win32.Injuke.gen
GData	AIT:Trojan.Nymeria.4398 (2x)
Cynet	Malicious (score: 100)
VBA32	suspected of VBS.EncodedMalware
ALYac	AIT:Trojan.Nymeria.4398
MAX	malware (ai score=87)
Malwarebytes	Backdoor.Remcos
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002H0CAT21
Rising	Trojan.Injector!8.C4 (TOPIS:E0:N8m2TxKYZRS)
Ikarus	Trojan.Autoit
Fortinet	AutoIt/Agent.5A2D!tr
AVG	Script:SNH-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (D)
Qihoo-360	Win32/Trojan.Loda.HoMASOEA