Malware

How to remove “Win32/Packed.Themida.GOF”?

Malware Removal

The Win32/Packed.Themida.GOF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Packed.Themida.GOF virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Checks for the presence of known windows from debuggers and forensic tools
  • The following process appear to have been packed with Themida: intervpnmix2.exe
  • Writes a potential ransom message to disk
  • Checks for the presence of known devices from debuggers and forensic tools
  • Detects the presence of Wine emulator via registry key
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
iplogger.org
a.tomx.xyz
jjload02.top

How to determine Win32/Packed.Themida.GOF?


File Info:

crc32: B89907D5
md5: 3fdae3ce0833a78d7b0ffe244c962ec0
name: intervpnmix2.exe
sha1: 3acd6fe6a2d51348b2b71cd947e92ff64b85a412
sha256: a3bb800e9abb643648da089e93c1b028fafce21eb9f2f10f8ec3a90f4b098aa1
sha512: 159145d741e2cbe67b859dd688bc8f88786e385bfe60f93bad4c5eb4c6fef505f60fdc797288d1b0a370de8c65054621bca33e41ccac693ed050c4af053f55dc
ssdeep: 196608:d5G3oFXzSHflKvlz/1tcko57xBTJu7sbsOeUA5jP/P8tnSmgs:dA3oFXzGflK9z17stliUSghgs
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Inter VPN SOFT Inc.
ProductVersion: 2.2.3.0
FileVersion: 2.2.3.0
FileDescription:
Translation: 0x0000 0x04b0

Win32/Packed.Themida.GOF also known as:

MicroWorld-eScanTrojan.PasswordStealer.GenericKD.42859757
ALYacTrojan.PasswordStealer.GenericKD.42859757
CylanceUnsafe
K7AntiVirusTrojan ( 005586921 )
BitDefenderTrojan.PasswordStealer.GenericKD.42859757
K7GWTrojan ( 005586921 )
TrendMicroTROJ_GEN.R002C0WCK20
SymantecTrojan.Gen.MBT
TrendMicro-HouseCallTROJ_GEN.R002C0WCK20
AvastWin32:Trojan-gen
ClamAVWin.Malware.Stralo-7590910-0
GDataWin32.Trojan.Ilgergop.L51Q3A
KasperskyTrojan-Downloader.Win32.Stralo.hl
AlibabaPacked:Win32/Themida.626734f3
AegisLabTrojan.Win32.Downeks.l!c
APEXMalicious
Ad-AwareTrojan.PasswordStealer.GenericKD.42859757
EmsisoftTrojan.PasswordStealer.GenericKD.42859757 (B)
F-SecureHeuristic.HEUR/AGEN.1038489
DrWebProgram.Unwanted.2892
ZillyaTrojan.GenericKD.Win32.30057
McAfee-GW-EditionBehavesLike.Win32.Dropper.rc
FireEyeGeneric.mg.3fdae3ce0833a78d
SophosMal/Generic-S
CyrenW32/Trojan.CURB-8476
AviraTR/Spy.Downeks.rhafv
MAXmalware (ai score=88)
Endgamemalicious (high confidence)
ArcabitTrojan.PasswordStealer.Generic.D28DFCED
ZoneAlarmHEUR:Trojan-Downloader.Win32.Stralo.gen
MicrosoftTrojan:Win32/Occamy.C
Acronissuspicious
McAfeeArtemis!3FDAE3CE0833
VBA32TrojanSpy.Downeks
MalwarebytesTrojan.Downloader.AHK.Themida
PandaTrj/CI.A
ESET-NOD32a variant of Win32/Packed.Themida.GOF
RisingSpyware.Downeks!8.E248 (CLOUD)
YandexRiskware.Unwanted!
IkarusTrojan-Downloader.Win32.Autohk
eGambitUnsafe.AI_Score_99%
FortinetW32/GenericKD.E3FB!tr
AVGWin32:Trojan-gen
Paloaltogeneric.ml
Qihoo-360Win32/Trojan.Spy.53a

How to remove Win32/Packed.Themida.GOF?

Win32/Packed.Themida.GOF removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment