Trojan

Win32/TrojanDownloader.IcedId.E information

Malware Removal

The Win32/TrojanDownloader.IcedId.E is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32/TrojanDownloader.IcedId.E virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid

How to determine Win32/TrojanDownloader.IcedId.E?



File Info:

name: 1B4DDF93E3748162527F.mlw
path: /opt/CAPEv2/storage/binaries/5a228d2f3b746b03e3891ee3e5e71e23e8f24714325443eedfae7f3d93431941
crc32: 303161C1
md5: 1b4ddf93e3748162527f3ad0ed132506
sha1: f578e90aa56660afd6c867f97c11c70050123b0b
sha256: 5a228d2f3b746b03e3891ee3e5e71e23e8f24714325443eedfae7f3d93431941
sha512: 0d1cc06ef9f2e82c5d391c0b89a99471d24fe90bd5ad1d70a1f1afd0503ed3b7df86e2a7e2a9e163689cb9165efd6aa5fd808b54920c9723a369b64699e99bd7
ssdeep: 6144:kyGEErqT+7I/FdI2lA4b/Ue7z7vOmV3v7u:kyfErqT+s/FLAUVv1Vf7u
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C5542A01BA918038F4F716F95AFD6269A63D7DE0376084CF53C426EE9625EE0AC30767
sha3_384: 7eb3a39425d8c3c9d4d795b1ef35aa6870c328b9dbc394c4f0e28125eba0c21188509b8c93275eed155e65c456496f4d
ep_bytes: 558bece828fdffff5dc3cccccccccccc
timestamp: 2015-08-06 01:45:59


Version Info:

LegalCopyright: ©Month HasEgg Carry Possible beg
CompanyName: Month HasEgg Carry
FileDescription: South Let
FileVersion: 8.4.16.67
ProductVersion: 8.4.16.67
InternalName: South Let
LegalTrademarks: South Let Hat Ha Month HasEgg Carry
OriginalFilename: Noth.exe
ProductName: South Let
BuildID: 43717821
Translation: 0x0000 0x04b0

Win32/TrojanDownloader.IcedId.E also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Sleltasos.4!c
MicroWorld-eScanGen:Variant.Zusy.316546
FireEyeGeneric.mg.1b4ddf93e3748162
ALYacGen:Variant.Zusy.316546
CylanceUnsafe
ZillyaDownloader.IcedId.Win32.247
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan-Downloader ( 005661ef1 )
AlibabaTrojanDownloader:Win32/Sleltasos.63be829b
K7GWTrojan-Downloader ( 005661ef1 )
Cybereasonmalicious.3e3748
CyrenW32/ABRisk.EVFT-6084
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32Win32/TrojanDownloader.IcedId.E
APEXMalicious
Paloaltogeneric.ml
KasperskyTrojan.Win32.Sleltasos.ft
BitDefenderGen:Variant.Zusy.316546
NANO-AntivirusTrojan.Win32.Zenpak.hxpcht
AvastWin32:Trojan-gen
TencentMalware.Win32.Gencirc.10ce0c4a
Ad-AwareGen:Variant.Zusy.316546
EmsisoftGen:Variant.Zusy.316546 (B)
DrWebTrojan.Dridex.701
VIPREGen:Variant.Zusy.316546
TrendMicroTrojanSpy.Win32.ICEDID.YXCFHZ
SophosGeneric ML PUA (PUA)
GDataGen:Variant.Zusy.316546
JiangminTrojan.PSW.Fareit.xmh
AviraHEUR/AGEN.1237831
MAXmalware (ai score=86)
ArcabitTrojan.Zusy.D4D482
ViRobotTrojan.Win32.Z.Icedid.294400
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.MalPe.C4206548
McAfeeGenericRXAA-AA!1B4DDF93E374
VBA32BScope.Trojan.Downloader
MalwarebytesTrojan.Downloader
TrendMicro-HouseCallTrojanSpy.Win32.ICEDID.YXCFHZ
RisingTrojan.Generic@AI.100 (RDML:9eE71Z+qQqQ7mEGg8LpBpw)
IkarusTrojan-Downloader.Win32.Icedid
MaxSecureTrojan.Malware.184381790.susgen
FortinetW32/Kryptik.HGHA!tr
BitDefenderThetaGen:NN.ZexaE.34742.ru0@aSGezgoi
AVGWin32:Trojan-gen
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Win32/TrojanDownloader.IcedId.E?

Win32/TrojanDownloader.IcedId.E removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment