What is “Virus:Win32/Ruirui!A”?

The Virus:Win32/Ruirui!A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Ruirui!A virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Enumerates running processes
• Reads data out of its own binary image
• Attempts to modify Internet Explorer’s start page
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Installs itself for autorun at Windows startup
• Attempts to modify proxy settings
• Creates a copy of itself

How to determine Virus:Win32/Ruirui!A?

File Info:
name: 798D1EB9593A716FE615.mlw
path: /opt/CAPEv2/storage/binaries/263ccde05ce08b43a2e4023f6b6ce1789a0780791a1e86119f439ebf52404d3c
crc32: 5CF3A863
md5: 798d1eb9593a716fe615eb2ab94d5169
sha1: 5d14d5fba4b224c48e278c752620bca7e2940a43
sha256: 263ccde05ce08b43a2e4023f6b6ce1789a0780791a1e86119f439ebf52404d3c
sha512: b3f26720fcfd21c3443c70688a544523607156e339802e421960bc0ad9c3a7ccb8db0ce3890a43aa1f746121dfc8f52bd6f7ad34cc71e8a38519733c673b4352
ssdeep: 6144:hpqoa8aLaC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCg:hpqaC/2OGAtkCP4cejGSOpRK3CLIi8
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B0F48E0273D680F1D85238711567E26A9B797D154726CE9BEBE03E339D311B0AF2A372
sha3_384: 1d3a9f507c927f5d622c29235d5d76c81993c4627a488c6175ea91513fea440f61502c0f465e70307dbc24e621417683
ep_bytes: 558bec83ec20535657e8220100008bf0
timestamp: 2008-12-24 09:00:07

Version Info:
FileVersion: 1
Product Name: explorer
Translation: 0x0809 0x04b0

Virus:Win32/Ruirui!A also known as:

How to remove Virus:Win32/Ruirui!A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.