WinGo/RemoteAdmin.Chaos.A potentially unsafe malicious file

The WinGo/RemoteAdmin.Chaos.A potentially unsafe is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What WinGo/RemoteAdmin.Chaos.A potentially unsafe virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Unconventionial language used in binary resources: Hungarian
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Installs itself for autorun at Windows startup
• Binary compilation timestomping detected

How to determine WinGo/RemoteAdmin.Chaos.A potentially unsafe?

File Info:
name: 2AA2EEEF2FB7EEC8FFF3.mlw
path: /opt/CAPEv2/storage/binaries/a6228b9abd5fc2cef30705ae2df8498595ac0dda24bf12515446a11373ea8951
crc32: C2BCD4D3
md5: 2aa2eeef2fb7eec8fff367b88dc867ed
sha1: 8298c816174198686775d68837ca737da4a6997c
sha256: a6228b9abd5fc2cef30705ae2df8498595ac0dda24bf12515446a11373ea8951
sha512: 4e631c6c01d6229e537e702110084ddf6c331ac52a54931d0d4354c2e5d73767a6bcf32a16b94b67fe9a47d85da82ed8f62cdb0a87ad7f3e323c032dde9a3fcd
ssdeep: 49152:SQWezhbYSe12d4noQBncdnEtF3J1pMdoB39Ivj0HF+KBCxkp:Sdap0q4o9dnMZWjeFt0
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T12DA5231AA9EC30F7D1B597FA21F20246D234F4914B7A8A8F6644C2F85F025E6B131F67
sha3_384: 99c161a9eab30409b9e9c748d8f4d089f580c75d1921e2aa00b77ca0261668e375e45a69fc2940df41bc42dc95cc66fc
ep_bytes: 4883ec28e85b0700004883c428e90600
timestamp: 2062-07-25 12:18:00

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Win32 kabinetfájl-önkibontó                                                        
FileVersion: 11.00.19041.1100 (WinBuild.160101.0800)
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. Minden jog fenntartva.
OriginalFilename: WEXTRACT.EXE            .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.19041.1100
Translation: 0x040e 0x04b0

WinGo/RemoteAdmin.Chaos.A potentially unsafe also known as:

How to remove WinGo/RemoteAdmin.Chaos.A potentially unsafe?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.