About “Win32:DomaIQ-CC [PUP]” infection

The Win32:DomaIQ-CC [PUP] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:DomaIQ-CC [PUP] virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Spanish (Modern)
• Authenticode signature is invalid
• CAPE detected the shellcode patterns malware family
• Detects Bochs through the presence of a registry key
• Attempts to modify proxy settings
• Touches a file containing cookies, possibly for information gathering
• Collects information to fingerprint the system
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32:DomaIQ-CC [PUP]?

File Info:
name: 7194411CA42B493D0F7C.mlw
path: /opt/CAPEv2/storage/binaries/2b4ec03c45a53cf75f350ef1589c0e54209f5c84b7c13b896fbb730041cddc42
crc32: 91364ABB
md5: 7194411ca42b493d0f7cbe71b8ada050
sha1: 081acc3cb816b04183995700af62498874be0943
sha256: 2b4ec03c45a53cf75f350ef1589c0e54209f5c84b7c13b896fbb730041cddc42
sha512: df7a7179c8824f1fade7e12425001efb6ebe626d7be6976c85360f474a49bded3a8ac5a2e65aab251eacff48393dcb9fe40a9e9263ee7cad14e8cfbd4574a02a
ssdeep: 6144:TGkORa/mgnXnr3cWfp64SYDYL8KZf6QPOCypMRLQmafsQQlwbmOMZoYIp:XOmmgnXr3cWfp6NOmJZf6QPOCyALQma/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T187849C2A33D4D967D96F4FB590A2466197B0D763D257F7C72E9838EE09E13800A03AD3
sha3_384: bd95d5272684a6999bca3686dbc719f2f99bb88e8bd9d8fd8ee1ac69be4f6e832f9d5c4d53d5c348be92a7be7f6fc753
ep_bytes: e8004b0000e989feffff8bff558bec83
timestamp: 2014-02-25 12:16:09

Version Info:
0: [No Data]

Win32:DomaIQ-CC [PUP] also known as:

How to remove Win32:DomaIQ-CC [PUP]?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.