Categories: Malware

About “Win32/Hematite.A” infection

The Win32/Hematite.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Hematite.A virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32/Hematite.A?


File Info:
name: 8BF1EE6F2E3D76EA32E5.mlwpath: /opt/CAPEv2/storage/binaries/dcbe469a364b32ae358e9ed7f3563318947849ad5e1cc5899e84665c01502389crc32: 28E7F9F7md5: 8bf1ee6f2e3d76ea32e53e52cb8e3bfasha1: 366b77f88e976e608e586f7ac79e4eb4ff2197a8sha256: dcbe469a364b32ae358e9ed7f3563318947849ad5e1cc5899e84665c01502389sha512: c1d05379f91ba84cd9ebfd92f4b50a56f56995902c7a2337ae94e89c0957e5a09a666d10a952925431a8564fc2c47816a224f6979dce59892a8dc5353d021f38ssdeep: 6144:gVzjPjjJmJPUcjy022w0XzJchzmUr29UYuo2LcYeFjdgPzNt9opQBg+Y/Z:0hI9uTpaJSzmguUYuo2LUmoTX/Ztype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T18EC4961262E54128F0F33A70697823350B7B7CA1AA3DC28F419855AD5EF3E80ED757A7sha3_384: e90c59685b1fe7ebbe15db919364cbfd856d890a71b13060fad30a95f37121b25d2b2e23e0e66efc3928a3aebdc76b13ep_bytes: b8001100002be087dbbe0004000187dbtimestamp: 2008-04-13 18:33:39
Version Info:
CompanyName: Microsoft CorporationFileDescription: Auto Check UtilityFileVersion: 5.1.2600.5512 (xpsp.080413-2111)InternalName: AutoChkLegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: AutoChk.ExeProductName: Microsoft® Windows® Operating SystemProductVersion: 5.1.2600.5512Translation: 0x0409 0x04b0

Win32/Hematite.A also known as:

Bkav	W32.AIDetectMalware
DrWeb	Win32.Siggen.29
MicroWorld-eScan	Trojan.GenericKDZ.102326
CAT-QuickHeal	W32.Infector.A5
Skyhigh	BehavesLike.Win32.HWorld.hm
McAfee	W32/HWorld!8BF1EE6F2E3D
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Virus ( 00508e1d1 )
K7GW	Virus ( 00508e1d1 )
Cybereason	malicious.f2e3d7
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Hematite.A
APEX	Malicious
Avast	Win32:Evo-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Ekstak.gen
BitDefender	Trojan.GenericKDZ.102326
NANO-Antivirus	Virus.Win32.Infector.emtrum
Tencent	Virus.Win32.Infector.ya
Emsisoft	Trojan.GenericKDZ.102326 (B)
Google	Detected
F-Secure	Trojan.TR/Agent.qhtpx
Baidu	Win32.Trojan.Agent.awj
VIPRE	Trojan.GenericKDZ.102326
FireEye	Generic.mg.8bf1ee6f2e3d76ea
Sophos	W32/HWorld-A
SentinelOne	Static AI – Malicious PE
Varist	W32/Trojan.DXT.gen!Eldorado
Avira	TR/Agent.qhtpx
MAX	malware (ai score=84)
Antiy-AVL	Virus/Win32.Infector.gen
Microsoft	Virus:Win32/Hematite.A
Xcitium	Virus.Win32.Hematite.A@77ycil
Arcabit	Trojan.Generic.D18FB6
ZoneAlarm	HEUR:Trojan.Win32.Ekstak.gen
GData	Trojan.GenericKDZ.102326
Cynet	Malicious (score: 100)
AhnLab-V3	Virus/Win.Hworld.R556194
VBA32	Virus.Hematite
ALYac	Trojan.GenericKDZ.102326
TACHYON	Virus/W32.Hematite
Cylance	unsafe
Rising	Virus.Hematite!1.EF53 (CLASSIC)
Ikarus	Trojan.Agent
MaxSecure	Virus.W32.Infector.Gen
Fortinet	W32/Agent.D17
AVG	Win32:Evo-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
alibabacloud	Virus:Win/HelloWorld.a(dyn)