Categories: Malware

Should I remove “Win32/Diskcoder.D”?

The Win32/Diskcoder.D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Diskcoder.D virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process created a hidden window
Performs some HTTP requests
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Creates a hidden or system file
Anomalous binary characteristics

Related domains:

edgedl.me.gvt1.com

How to determine Win32/Diskcoder.D?


File Info:
crc32: 0AA84AEAmd5: a462d093840217fc931927d1f79cf3b3name: A462D093840217FC931927D1F79CF3B3.mlwsha1: 2ffaf51088039c911b737c1188bb721c54724efdsha256: 2105757bdfc4305864c9734b71a41f2154b5bae164e5d5279901168cd7a21254sha512: 6748d832b8f7439b205837974775e0d387f80cedab84956d3a49066e5c65e621dfd1410c8892a0d15d60283a59ed1dc0bd79ea8cbf9b9cd48bbdfd76438482e0ssdeep: 3072:gkeK/MwGT0834YW3pvyh8fcl/iL62iL6KK:5n/MZd4YW3pvyxl/initype: PE32 executable (console) Intel 80386, for MS Windows
Version Info:
LegalCopyright: http://diskcryptor.net/FileVersion: 1.1.846.118ProductName: GrayWormProductVersion: 1.1FileDescription: Microsoft Display Class InstallerOriginalFilename: dispci.exeTranslation: 0x0009 0x04b0

Win32/Diskcoder.D also known as:

Bkav	W32.FamVT.RabbitND.Worm
Elastic	malicious (high confidence)
DrWeb	Trojan.BadRabbit.1
ClamAV	Win.Ransomware.BadRabbit-6355461-2
CAT-QuickHeal	Ransom.BadRabbit.B5
ALYac	Trojan.Ransom.BadRabbit
Cylance	Unsafe
Alibaba	Ransom:Win32/BadRabbit.f4539ebe
K7GW	Trojan ( 0051a2c11 )
K7AntiVirus	Trojan ( 0051a2c11 )
Cyren	W32/DiskCoder.B.gen!Eldorado
Symantec	Ransom.BadRabbit!g2
ESET-NOD32	a variant of Win32/Diskcoder.D
Zoner	Trojan.Win32.64023
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Ransom.Win32.BadRabbit.a
BitDefender	Gen:Heur.Ransom.REntS.Gen.1
NANO-Antivirus	Trojan.Win32.BadRabbit.gkdfrh
ViRobot	Trojan.Win32.Agent.142848.Q
MicroWorld-eScan	Gen:Heur.Ransom.REntS.Gen.1
Tencent	Malware.Win32.Gencirc.10bab887
Ad-Aware	Gen:Heur.Ransom.REntS.Gen.1
Sophos	Troj/Ransom-ERK
BitDefenderTheta	Gen:NN.ZexaF.34142.iu0@airDS8di
TrendMicro	Ransom_BADRABBIT.SMD
McAfee-GW-Edition	Ransomware-GGD!A462D0938402
FireEye	Generic.mg.a462d093840217fc
Emsisoft	Trojan-Ransom.BadRabbit (A)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.BadRabbit.e
Avira	HEUR/AGEN.1108025
eGambit	ransom.BadRabbit
Antiy-AVL	Trojan/Generic.ASMalwS.2D1A63B
Microsoft	Ransom:Win32/Tibbar.A
Arcabit	Trojan.Ransom.REntS.Gen.1
GData	Win32.Trojan-Ransom.BadRabbit.A
TACHYON	Ransom/W32.BadRabbit.142848
AhnLab-V3	Trojan/Win32.Diskcoder.C2212682
McAfee	Ransomware-GGD!A462D0938402
MAX	malware (ai score=85)
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Ransom_BADRABBIT.SMD
Rising	Ransom.Badrabbit!1.AC3A (CLASSIC)
Yandex	Trojan.GenAsa!GOIkZHLHb7A
Ikarus	Trojan-Ransom.BadRabbit
MaxSecure	Trojan.Malware.11499427.susgen
Fortinet	W32/Diskcoder.D!tr.ransom
AVG	Win32:Malware-gen
Paloalto	generic.ml