VHO:Trojan-Downloader.Win32.Genome (file analysis)

Malware Removal

The VHO:Trojan-Downloader.Win32.Genome is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What VHO:Trojan-Downloader.Win32.Genome virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Reads data out of its own binary image
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Tries to unhook or modify Windows functions monitored by Cuckoo
  • Network activity detected but not expressed in API logs

How to determine VHO:Trojan-Downloader.Win32.Genome?


File Info:

crc32: 5D8FF26E
md5: e3dd0bbcefbd59b7ee8d7d87ba1e8d07
name: E3DD0BBCEFBD59B7EE8D7D87BA1E8D07.mlw
sha1: 31dd0297389b61ffcda8140f013c73e2a6165b56
sha256: c127b14130c48abcd2eb7acdb417aea11604323ba0965560b53a79fc830dafa6
sha512: a6f45b4d0a317033d9717ea889e13b0f70cb3ae05f0601c118f6f2778df259160dbd55b81a35cce8fc396a0748ca67a1b3e37b0b3c065c6ad15a3e89e8d1d4a9
ssdeep: 12288:gCwCdP//zkKfwJTj1qrsn74tCb3/hZKiyS1BR5nWFpPoShMwA:gMdPTkywB1esn7WCjhZKiyS1Ubc7
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: x7248x6743x6240x6709xff1aie163.taobao.com
FileVersion: 1.0.0.3
CompanyName: ie163.taobao.com
Comments: ie163.taobao.com
ProductName: BOSSx8ba1x65f6x5668
ProductVersion: 1.0.0.3
FileDescription: BOSSx8ba1x65f6x5668
Translation: 0x0804 0x04b0

VHO:Trojan-Downloader.Win32.Genome also known as:

BkavW32.AIDetect.malware2
K7AntiVirusTrojan ( 005246d51 )
Elasticmalicious (high confidence)
ClamAVWin.Malware.Generic-9820446-0
CylanceUnsafe
K7GWAdware ( 004b8c491 )
Cybereasonmalicious.7389b6
CyrenW32/S-9a0e6078!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEXMalicious
CynetMalicious (score: 100)
KasperskyVHO:Trojan-Downloader.Win32.Genome.gen
SophosGeneric ML PUA (PUA)
ComodoWorm.Win32.Dropper.RA@1qraug
BitDefenderThetaGen:NN.ZexaF.34266.3q0@aiCN4Tob
McAfee-GW-EditionBehavesLike.Win32.Generic.ch
FireEyeGeneric.mg.e3dd0bbcefbd59b7
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_99%
Antiy-AVLTrojan/Generic.ASCommon.FA
KingsoftWin32.Troj.Undef.(kcloud)
GDataWin32.Trojan.PSE.11B5R9D
Acronissuspicious
McAfeeGenericRXAA-SA!E3DD0BBCEFBD
VBA32BScope.Trojan.Fuerboos
MalwarebytesTrojan.MalPack.FlyStudio
RisingMalware.Heuristic!ET#95% (RDMK:cmRtazofRWX7YcFjMTgT40UlBmWR)
YandexTrojan.GenAsa!3nrLpeEQWWY
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/CoinMiner.65CA!tr

How to remove VHO:Trojan-Downloader.Win32.Genome?

VHO:Trojan-Downloader.Win32.Genome removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment