Virus.Virut.14 malicious file

Malware Removal

The Virus.Virut.14 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Review

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Virus.Virut.14 virus can do?

  • Injection with CreateRemoteThread in a remote process
  • Attempts to connect to a dead IP:Port (2 unique times)
  • Creates RWX memory
  • Loads a driver
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Uses Windows utilities for basic functionality
  • Code injection with CreateRemoteThread in a remote process
  • Deletes its original binary from disk
  • A process attempted to delay the analysis task by a long amount of time.
  • Tries to unhook or modify Windows functions monitored by Cuckoo
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Creates a copy of itself
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
ilo.brenz.pl
a.tomx.xyz
ip.yototoo.com
rcvboe.com
ant.trenz.pl
okdcuv.com
ogdczo.com
tpfhoo.com
sekmtg.com
wgxnyr.com
asupry.com
akyzzh.com
xxvhck.com
bdteuo.com
ynayhe.com
aouroq.com
zinsdo.com
qousfw.com
wooexf.com
dkjazx.com
npuzat.com
mikbtk.com
lenoob.com
rpxsux.com
yujofr.com
iqmbxe.com
iopfsu.com
otvobu.com
yiaccy.com
iemxbw.com
pnsiiv.com
eqahvn.com
iyeukz.com
wnirxz.com
adlihl.com
cuycoh.com
surppa.com
qaerzs.com
ddpwkv.com
reopzy.com
dhiehu.com
nyirce.com
pyxtbc.com
zklghi.com
xpsdaa.com
hflnnv.com
auuiga.com
nkygec.com
aeguho.com
ojhgsy.com
ftyyzq.com
fykdhp.com
yiidod.com
jnlims.com
aakoid.com
eneary.com
zrokqd.com
cnesaf.com
zfrsqr.com
mlohoy.com
ttuxcx.com
ufbeke.com
besbbw.com
oezeru.com
zfblfw.com
eewaax.com
uopvrc.com
tditty.com
rqrojq.com
oiboyc.com
usovka.com
eoioae.com
zsvynp.com
btykhi.com
cuewjs.com
feqjui.com
dxxnyo.com
jlhiao.com
cxcazh.com
ssuajr.com
rypxpt.com
vqeres.com
rpevha.com
lidaxa.com
lmoupq.com
mcnoao.com
ipomdb.com
aofdop.com
iicmhn.com
guxiyn.com
hysybk.com
psqdiw.com
iahplq.com
ghysez.com
ejpsbh.com
ryjybc.com
pfimqb.com
recfez.com
ilulei.com
ptivtj.com
qquegh.com
mhalpo.com
liuqyf.com
xjiaqc.com

How to determine Virus.Virut.14?


File Info:

crc32: 74141A1F
md5: 8ecdd9afac9ebe0021a2b8284a0e981a
name: 5.exe
sha1: 24a60afa7c1503210c395cc59e09a5f12bee5a6f
sha256: 2d9849f4b59973fda530633321a1bd5fed7761197f7e15a07a45e60345294409
sha512: 54167568583e1a64533179bf0510cd5a1573e86f65363f00d885ac4daf46936ed0705ace21c7312b1a0d48c70582395edc35bc6e0be6cd7740e30e5180e12ccb
ssdeep: 768:+8b4nCYH+s9roF3YtseGvmJI5disV4Cp+zvsSmdothVFHs/2x1qrVO0AH1EZ7xB:2TH96aO5AjzvFmW7dfgVO0vV3Im
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Virus.Virut.14 also known as:

BkavW32.Vetor.PE
DrWebWin32.Virut.56
MicroWorld-eScanWin32.Virtob.Gen.12
FireEyeGeneric.mg.8ecdd9afac9ebe00
McAfeeW32/Virut.n.gen
MalwarebytesTrojan.ServStart
VIPREVirus.Win32.Virut.ce.5 (v)
SangforMalware
K7AntiVirusTrojan ( 004bcce41 )
BitDefenderWin32.Virtob.Gen.12
K7GWTrojan ( 004bcce41 )
Cybereasonmalicious.fac9eb
TrendMicroPE_VIRUX.R
BitDefenderThetaAI:FileInfector.C9457D4313
CyrenW32/Virut.E.gen!Eldorado
SymantecW32.Virut.CF
TotalDefenseWin32/Virut.17408
TrendMicro-HouseCallPE_VIRUX.R
AvastWin32:Vitro
ClamAVWin.Worm.Agent-5819819-0
GDataWin32.Virtob.Gen.12
KasperskyVirus.Win32.Virut.ce
AlibabaVirus:Win32/Virut.cd422a80
NANO-AntivirusVirus.Win32.Virut.hpeg
ViRobotWin32.Virut.Gen.C
AegisLabVirus.Win32.Virut.llV9
RisingVirus.Virut!1.A08B (CLOUD)
Endgamemalicious (moderate confidence)
SophosW32/Scribble-B
ComodoPacked.Win32.MUPX.Gen@24tbus
F-SecureMalware.W32/Virut.Gen
BaiduWin32.Virus.Virut.gen
ZillyaVirus.Virut.Win32.1938
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Virut.pc
Trapminemalicious.high.ml.score
CMCVirus.Win32.Virut.1!O
EmsisoftWin32.Virtob.Gen.12 (B)
IkarusTrojan-Downloader.Win32.Small
F-ProtW32/Virut.E.gen!Eldorado
JiangminWin32/Virut.bt
MaxSecureVirus.Virut.CE
AviraW32/Virut.Gen
MAXmalware (ai score=81)
Antiy-AVLVirus/Win32.Virut.ce
KingsoftWin32.Virut.oo.368640
MicrosoftVirus:Win32/Virut.BO
ArcabitWin32.Virtob.Gen.12
ZoneAlarmVirus.Win32.Virut.ce
CynetMalicious (score: 100)
AhnLab-V3Win32/Virut.F
Acronissuspicious
VBA32Virus.Virut.14
TACHYONVirus/W32.Virut.Gen
Ad-AwareWin32.Virtob.Gen.12
CylanceUnsafe
PandaW32/Sality.AO
APEXMalicious
ESET-NOD32Win32/Virut.NBP
TencentVirus.Win32.Virut.Gen.200001
YandexWin32.Virut.AB.Gen
SentinelOneDFI – Malicious PE
eGambitUnsafe.AI_Score_99%
FortinetW32/Virtu.F
AVGWin32:Vitro
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Virus.Win32.Virut.M

How to remove Virus.Virut.14?

Virus.Virut.14 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment