Categories: Malware

Should I remove “W32.Runouce.CR2”?

The W32.Runouce.CR2 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What W32.Runouce.CR2 virus can do?

Reads data out of its own binary image
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Creates an autorun.inf file
Authenticode signature is invalid
Deletes executed files from disk
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine W32.Runouce.CR2?


File Info:
name: 8EC0BB72A8BEF08EC8CF.mlwpath: /opt/CAPEv2/storage/binaries/8f7c8170f96ce138792808075d777e754dcda988a57ddb92c99e1294497b77d2crc32: 8A4EDD62md5: 8ec0bb72a8bef08ec8cf2953dcac72f3sha1: 7832df0999f5eb9ddc28670c50a86ef13c7ec6b5sha256: 8f7c8170f96ce138792808075d777e754dcda988a57ddb92c99e1294497b77d2sha512: c18578870d75ff919f56f0db1032ac530489c1aa7dfce056a6cdfde89184a856d7a93e0bd6d08729bb0b42f9585406e7c4b71d2c88342bbc6eb70663c0dcab28ssdeep: 393216:77vtmFZkcFdHsWpcPetqwRG7YJRZ63NcknZ:7Ltmbks/cwpUNTnZtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B8E6336C99EAD313D8F20470043E86E597B1DCA4FAE29383B7F3768E5672A112973507sha3_384: 91900621005d567c9fc4a3f1bd0eed8c093d3a76df9465180961238d1e650263898ca84f8cbce65ecdf4d5f89900f5e6ep_bytes: e82c2e0000e916feffff558bec83ec04timestamp: 2002-01-24 01:46:56
Version Info:
Comments: Created with Setup Factory 8.0FileDescription: Setup ApplicationFileVersion: 8.1.1000.0InternalName: suf80_launchLegalCopyright: Setup Engine Copyright © 2004-2008 Indigo Rose CorporationLegalTrademarks: Setup Factory is a trademark of Indigo Rose Corporation.OriginalFilename: suf80_launch.exeProductName: Setup Factory 8.0 RuntimeProductVersion: 8.1.1000.0Translation: 0x0409 0x04e4

W32.Runouce.CR2 also known as:

Lionic	Trojan.Win32.Generic.4!c
FireEye	Generic.mg.8ec0bb72a8bef08e
CAT-QuickHeal	W32.Runouce.CR2
Malwarebytes	VB.Trojan.Generic.DDS
Zillya	Worm.Runouce.Win32.4894
Sangfor	Worm.Win32-Script.Save.Nimda
Alibaba	Worm:Win32/fragment.014ae04b
Cybereason	malicious.999f5e
VirIT	Win32.Chir.B
Cyren	W32/Agent.JX.gen!Eldorado
Elastic	malicious (high confidence)
APEX	Malicious
ClamAV	Win.Worm.Brontok-88
Avast	Win32:Agent-BARL [Trj]
McAfee-GW-Edition	BehavesLike.Win32.Virus.vc
Trapmine	suspicious.low.ml.score
Antiy-AVL	Worm[NET]/Win32.Nimda.gic
McAfee	Artemis!8EC0BB72A8BE
TrendMicro-HouseCall	TROJ_GEN.R002C0REE23
Ikarus	Net-Worm.Win32.Nimda
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Chir.C!tr
AVG	Win32:Agent-BARL [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (D)