Win32/SchwarzeSonne removal tips

The Win32/SchwarzeSonne is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/SchwarzeSonne virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Uses Windows utilities for basic functionality
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• CAPE detected the shellcode get eip malware family
• Creates a copy of itself
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/SchwarzeSonne?

File Info:
name: 8A7023266D825D34566E.mlw
path: /opt/CAPEv2/storage/binaries/f952f1ebfb23c1e804d05d26ba31845a5d13322725e35f137a94106f774396b6
crc32: 2648C7D3
md5: 8a7023266d825d34566e149d77d7ea6f
sha1: b5c308e9445da728f16e5924d6b2148821425f91
sha256: f952f1ebfb23c1e804d05d26ba31845a5d13322725e35f137a94106f774396b6
sha512: dd320a47bc34c2232ee9c1077f5a7e369f9f206aa444de2bf27ee0763cb55d5fbf25d06849b2f86e553492fd4e7fbc6b87af7bf38e3d384504af39ab6b6c63cc
ssdeep: 6144:pdD5neKUDlB2ah46zLLEderDp8CxyDBu22FzuEGj3sxpf:LEjDlAVpeYu2uqEGjcz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E9549DD1B7D450A3F7E2B9BD9A70F5EE896FB8B02EB4D1142414D089F578F04A92AF01
sha3_384: a57a34b39eed30c8dbecfb4896b6c348dfe1064ff316bf79646936a8698ec2bd4fc82b495affd371fa4e0182b02cba17
ep_bytes: f9720442cb72ee6072062cbd1db7e8c6
timestamp: 1992-06-19 22:22:17

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft® Remote Desktop Help Session Manager
FileVersion: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName: SessMgr.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: SessMgr.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 5.1.2600.2180
Translation: 0x0409 0x04b0

Win32/SchwarzeSonne also known as:

How to remove Win32/SchwarzeSonne?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.