Win32:Hematite-G [Inf] malicious file

The Win32:Hematite-G [Inf] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:Hematite-G [Inf] virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Win32:Hematite-G [Inf]?


File Info:
name: 306CBF4087E7CF7DE85A.mlw
path: /opt/CAPEv2/storage/binaries/f39930bb7aba98b3a8550f2bb1518d89067c0788881d6ff8fff5bcae41e57f9a
crc32: 3BC2AA07
md5: 306cbf4087e7cf7de85a0fad88b48f38
sha1: 99eebec3f68ee50b131a87f348690b9ee4b985fc
sha256: f39930bb7aba98b3a8550f2bb1518d89067c0788881d6ff8fff5bcae41e57f9a
sha512: 7af887739ba0692df82b710aa542c32f8e0c8c3885df2a81285abba8a9dc3d6efa43b7a7fccaa7ea96372f740106763291994e68b26dfd560429c8a5dc96f190
ssdeep: 192:RxOwmTMpu5QlmTMp7xOwmTMpu5QlmTMp:bvsMpu5QlsMp1vsMpu5QlsMp
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T14822961F77148CD0D308473B28538DC66EA9B230CFA5A21D1ED6159A3A7642FE5BCF4A
sha3_384: 0aa8c840177a5119f648ea6635ab1677dcd9bf408237040ac637bf369a68b4053624ba1e1fd58cfd227900cbb0c25c5b
ep_bytes: 55eb05eb89e5eb03ebfa740f3183e00a
timestamp: 2024-02-07 01:38:29

Version Info:
0: [No Data]

Win32:Hematite-G [Inf] also known as:

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Multiplier.2
CAT-QuickHeal	Trojan.Bitrep.S1661176
Skyhigh	BehavesLike.Win32.Generic.lz
McAfee	GenericRXAA-AA!306CBF4087E7
Cylance	unsafe
Zillya	Trojan.AgentGen.Win32.83
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 00015e0f1 )
K7GW	Trojan ( 00015e0f1 )
Cybereason	malicious.3f68ee
Arcabit	Trojan.Multiplier.2
BitDefenderTheta	AI:Packer.FA78DDD91F
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent.ACIB
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	Trojan.Win32.Agentc.h
BitDefender	Gen:Variant.Multiplier.2
NANO-Antivirus	Trojan.Win32.Generic.fhoiko
Avast	Win32:Hematite-G [Inf]
Tencent	Trojan.Win32.Agent.zy
Emsisoft	Gen:Variant.Multiplier.2 (B)
VIPRE	Gen:Variant.Multiplier.2
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.306cbf4087e7cf7d
Sophos	Troj/Mdrop-JCF
SentinelOne	Static AI – Malicious PE
Varist	W32/S-8b1de2d3!Eldorado
MAX	malware (ai score=85)
Antiy-AVL	Trojan/Win32.TSGeneric
Kingsoft	malware.kb.a.998
Microsoft	Trojan:Win32/Hematite.DHA!MTB
ZoneAlarm	Trojan.Win32.Agentc.h
GData	Win32.Trojan.PSE.10KKX95
Google	Detected
AhnLab-V3	Malware/Win32.Generic.C2248719
Acronis	suspicious
ALYac	Gen:Variant.Multiplier.2
VBA32	Trojan.Agentc
Malwarebytes	Malware.AI.3047760236
Panda	Trj/Genetic.gen
Rising	Trojan.Agent!1.CD9B (CLASSIC)
Yandex	Trojan.GenAsa!pjEK63c5pCk
Ikarus	Trojan.Win32.Agent
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/GenericRXGB.FM!tr
AVG	Win32:Hematite-G [Inf]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Win32:Hematite-G [Inf]?

Win32:Hematite-G [Inf] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X