Categories: Malware

What is “Win32/Packed.Obsidium.IZ”?

The Win32/Packed.Obsidium.IZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Packed.Obsidium.IZ virus can do?

Behavioural detection: Executable code extraction – unpacking
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Checks for the presence of known devices from debuggers and forensic tools
Checks for the presence of known devices from debuggers and forensic tools
Anomalous binary characteristics
Binary compilation timestomping detected

How to determine Win32/Packed.Obsidium.IZ?


File Info:
name: 4AC7153E8387EE5D13DC.mlwpath: /opt/CAPEv2/storage/binaries/07b467a99e7e8e66d8c5d48574b057316ab7c0d6c14b811853cc1247e9d3a288crc32: 1A0D97FAmd5: 4ac7153e8387ee5d13dc880313c35f71sha1: caf5fed053e160d2475fa820daddfb6023e58254sha256: 07b467a99e7e8e66d8c5d48574b057316ab7c0d6c14b811853cc1247e9d3a288sha512: 49ec9dc0aa90fda3d5e89e6b35f3f7ad376a8f359cdc5089203cf7436e94784764a02df18c46072745145fa0b30cdf7480d7fcacf44a6bf98a04fb5bc463c4d5ssdeep: 98304:N8R59Uug7Q2F8q6rJF1AZZ8scGRcjcUNT6RnRp1F9m60pz+1cedv7:N8D87WrJF1ajP8/OdRji6leeJ7type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D626238285430D50C8201EB8A11A5D34969FAFEF3E3AE5D2ADD8F97A73F71E48174436sha3_384: 0edf1fed5f7bb540006adaa442c4ea77414621cdea6bbf73f9f126acfb8a40cf41ad4999160b6a3732bab45f4dcb1ad9ep_bytes: eb022d0a50eb02bb7fe81a000000eb04timestamp: 2094-05-17 20:53:52
Version Info:
CompanyName: Samsung ElectronicsFileDescription: Samsung Portable SSD SoftwareFileVersion: 1.6.7.50InternalName: SamsungPortableSSD.exeLegalCopyright: Copyright (C) 2018 Samsung ElectronicsOriginalFilename: SamsungPortableSSD.exeProductName: Samsung Portable SSD SoftwareProductVersion: 1.6.7.50Translation: 0x0400 0x04b0

Win32/Packed.Obsidium.IZ also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Obsidium.4!c
MicroWorld-eScan	Trojan.GenericKD.63233831
CAT-QuickHeal	Trojan.Agent
ALYac	Trojan.GenericKD.63233831
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Alibaba	Packed:Win32/Obsidium.24138047
Cybereason	malicious.053e16
Cyren	W32/Obsidium.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.Obsidium.IZ
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	UDS:Backdoor.Win32.Agent.a
BitDefender	Trojan.GenericKD.63233831
Tencent	Win32.Trojan.Agen.Rzfl
Ad-Aware	Trojan.GenericKD.63233831
Emsisoft	Trojan.GenericKD.63233831 (B)
F-Secure	Heuristic.HEUR/AGEN.1246874
Zillya	Trojan.Obsidium.Win32.4637
McAfee-GW-Edition	BehavesLike.Win32.Virus.rc
FireEye	Generic.mg.4ac7153e8387ee5d
Sophos	Generic PUA MK (PUA)
Ikarus	Trojan.Win32.Obsidium
Avira	HEUR/AGEN.1246874
Antiy-AVL	Trojan/Generic.ASMalwS.516A
Kingsoft	Win32.Troj.Generic.jm.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Generic.D3C4DF27
ZoneAlarm	UDS:Backdoor.Win32.Agent.a
GData	Trojan.GenericKD.63233831
Google	Detected
AhnLab-V3	Infostealer/Win.RedLine.C5040156
Acronis	suspicious
McAfee	Artemis!4AC7153E8387
MAX	malware (ai score=80)
Malwarebytes	Trojan.MalPack.Obsidium
TrendMicro-HouseCall	TROJ_GEN.R002H0CK122
Rising	Exploit.Shellcode!8.2A (TFE:3:KFHhLF2TKpH)
Fortinet	W32/PossibleThreat
BitDefenderTheta	Gen:NN.ZexaF.34754.@t0@aCamWSmi
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_90% (W)