Ransom Trojan

VHO:Trojan-Ransom.Win32.Birele malicious file

Malware Removal

The VHO:Trojan-Ransom.Win32.Birele is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What VHO:Trojan-Ransom.Win32.Birele virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • Performs some HTTP requests
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Uses Windows utilities for basic functionality
  • Exhibits possible ransomware file modification behavior
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

s3.51start.online
www.bing.com

How to determine VHO:Trojan-Ransom.Win32.Birele?


File Info:

crc32: DA86997A
md5: ccf0d07ceb5bbf82a5be2ce9ebfc54c2
name: CCF0D07CEB5BBF82A5BE2CE9EBFC54C2.mlw
sha1: adf59e9fd9020569ca386cecac08fdecafe426ab
sha256: 09f17fe9283136e73676e3997e6eecc47c9a477f092087914be86e4ba3c384f2
sha512: c6e08c5cab96de61c8335848dac3372d434131687034e894af56be9ae8afc2970273dd4cbbf40d102d5c199504f97a4a96decd2f3231e687c5cd354b9749ad01
ssdeep: 1536:I2FMt6PtrdCGLflqBLvNcnmgejJVjRyStdnc5XbJsWjcdUXs+tMfxiZ:IfOjC26JcFjStdpUc+tMAZ
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2018
FileVersion: 1.0.0.2
ProductVersion: 1.0.0.2
Translation: 0x0804 0x04b0

VHO:Trojan-Ransom.Win32.Birele also known as:

Elasticmalicious (high confidence)
CynetMalicious (score: 100)
CrowdStrikewin/malicious_confidence_80% (D)
SymantecML.Attribute.HighConfidence
APEXMalicious
ClamAVWin.Dropper.Fagi-9846306-0
KasperskyVHO:Trojan-Ransom.Win32.Birele.gen
TencentMalware.Win32.Gencirc.10b55219
SophosML/PE-A
ComodoMalware@#2podvzxkz3x3n
BitDefenderThetaGen:NN.ZexaF.34690.gu1@aW0Ml4kj
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.Generic.ch
FireEyeGeneric.mg.ccf0d07ceb5bbf82
AviraTR/Crypt.XPACK.Gen
MicrosoftTrojan:Win32/Wacatac.B!ml
AegisLabTrojan.Win32.Generic.4!c
McAfeeGeneric-FAGI!CCF0D07CEB5B
MAXmalware (ai score=95)
MalwarebytesMalware.AI.1587489576
PandaTrj/Genetic.gen
RisingMalware.Undefined!8.C (CLOUD)
YandexTrojan.GenAsa!DaZHyQAWI4g
FortinetW32/PossibleThreat
Paloaltogeneric.ml

How to remove VHO:Trojan-Ransom.Win32.Birele?

VHO:Trojan-Ransom.Win32.Birele removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment