Categories: Malware

Win32.Morto.A removal tips

The Win32.Morto.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32.Morto.A virus can do?

Sample contains Overlay data
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Attempts to identify installed AV products by registry key
Adds itself to the Safe Mode boot to ensure its start
Yara detections observed in process dumps, payloads or dropped files

How to determine Win32.Morto.A?


File Info:
name: C242B7EA5788241B68CE.mlwpath: /opt/CAPEv2/storage/binaries/d0295452e30ffd6a3135be23c378d05746981bdcb2db62fb97aa44b276cddc7ecrc32: 88F4B139md5: c242b7ea5788241b68ce962ce4c83767sha1: 3f12098d242e21ab1d30a61ba6859647a50859c6sha256: d0295452e30ffd6a3135be23c378d05746981bdcb2db62fb97aa44b276cddc7esha512: 043e1304567c3384ec37b83e7a0465d4eafabeb69f47ae4fef6379eb15afaa506e1fb93427757ef955b6fdc3310f128439927e0b49f2f83071d466ddcf3ea1a2ssdeep: 3072:7X/4eI9RNZAOKCQp5hhPo9FpxiDRuwEkXin+RwmHi:j/1Fbhii+aHitype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T193C39D1BB7D08422D780C630255CDB32AEBAF95A1E37DA53CF565A297C30483566E38Bsha3_384: c861b77e0091f08c7666351081d3c2851d6535291f208522317cc63c9125c87541d656c96e7f76f1796851929f46e61dep_bytes: 60e8000000005883c02d33db8b0c1881timestamp: 1999-01-12 18:42:19
Version Info:
CompanyName: InstallShield Software CorporationFileDescription: 32-bit Setup LauncherFileVersion: 5, 52, 164, 0LegalCopyright: Copyright© 1990-1998 InstallShield Software Corporation, Phone: (847) 240-9111ProductName: InstallShield®ProductVersion: 5, 52Translation: 0x0409 0x04e4

Win32.Morto.A also known as:

Bkav	W32.PeLoginPCPDM.PE
Lionic	Worm.Win32.Fipp.lVdm
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Morto.A
FireEye	Generic.mg.c242b7ea5788241b
CAT-QuickHeal	W32.Fipp.A
Skyhigh	BehavesLike.Win32.Infected.ch
McAfee	W32/Pift
Cylance	unsafe
Zillya	Virus.Morto.Win32.1
Sangfor	Virus.Win32.Morto.Vbxj
K7AntiVirus	Virus ( 003bf6591 )
Alibaba	Virus:Win32/Morto.8056ebb2
K7GW	Virus ( 003bf6591 )
BitDefenderTheta	AI:FileInfector.AEB21B9D0D
VirIT	Win32.Fipp.C
Symantec	W32.Morto.B
ESET-NOD32	Win32/Morto.A
APEX	Malicious
TrendMicro-HouseCall	PE_MUSTAN.A
Paloalto	generic.ml
ClamAV	Win.Virus.Morto-2537
Kaspersky	Worm.Win32.Fipp.a
BitDefender	Win32.Morto.A
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
Avast	Win32:Motor [Inf]
Tencent	Virus.Win32.Fipp.c
Emsisoft	Win32.Morto.A (B)
Baidu	Win32.Virus.Fipp.a
F-Secure	Malware.W32/Fipp.A
DrWeb	Win32.Morto.1
VIPRE	Win32.Morto.A
TrendMicro	PE_MUSTAN.A
Trapmine	malicious.high.ml.score
Sophos	W32/Fipp-A
Ikarus	Virus.Win32.Morto
Jiangmin	Worm/Fipp.akx
Webroot	W32.Virus.A
Google	Detected
Avira	W32/Fipp.A
Varist	W32/Morto.H.gen!Eldorado
Antiy-AVL	Worm/Win32.Fipp.a
Kingsoft	Win32.Fipp.lx.205056
Microsoft	Virus:Win32/Morto.A
Xcitium	Worm.Win32.Fipp.A@4plt1o
Arcabit	Win32.Morto.A
ViRobot	Win32.Fipp.A
ZoneAlarm	Worm.Win32.Fipp.a
GData	Win32.Morto.A
Cynet	Malicious (score: 100)
AhnLab-V3	Win32/Fipp.X800
VBA32	Virus.Win32.Fip
ALYac	Win32.Morto.A
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware/Suspicious
Panda	W32/Morto.D
Zoner	Probably Heur.ExeHeaderL
Rising	Virus.Cisig!1.9B74 (CLASSIC)
Yandex	Win32.Fipp.A
SentinelOne	Static AI – Malicious PE
MaxSecure	Worm.W32.Fipp.A
Fortinet	W32/Fipp.A!tr
AVG	Win32:Motor [Inf]
DeepInstinct	MALICIOUS
alibabacloud	Trojan