Categories: Worm

What is “Worm.Brontok”?

The Worm.Brontok is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm.Brontok virus can do?

Executable code extraction
Reads data out of its own binary image
Drops a binary and executes it
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Mimics the file times of a Windows system file
Installs itself for autorun at Windows startup
Creates a hidden or system file
Creates a copy of itself
Anomalous binary characteristics

Related domains:

www.geocities.com

How to determine Worm.Brontok?


File Info:
crc32: 1F472A8Bmd5: 454224e38ead1d402f0d2bad5ab7c302name: mods.exesha1: a4f2a721de4e94a6db76790f7f522c2ea61737fcsha256: bdbf13afaa23ef896c9389108078da88e018b12ed5f66510f5fac52afbadeaf4sha512: ad8678b44d68eb27374170ecca637170e197dda07fb8126201b277f48d60e6c6d8200c3882cedcadd067759c04d7b529a77a653120ca65f7c9e69985e834ce13ssdeep: 1536:r5AakFmuH8d3pDfT9tdXVC8/o59BAczowsjjv044:6agmvJfdXVCkYqcI0ftype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
Translation: 0x0409 0x04b0InternalName: Brontok.AFileVersion: 1.00.0004CompanyName:  Comments:  ProductName: Brontok.AProductVersion: 1.00.0004OriginalFilename: Brontok.A.HVM31

Worm.Brontok also known as:

Bkav	W32.SalityT.PE
MicroWorld-eScan	Win32.Brontok.AP@mm
CMC	Virus.Win32.Sality!O
CAT-QuickHeal	W32.Sality.K
ALYac	Win32.Brontok.AP@mm
Cylance	Unsafe
VIPRE	Virus.Win32.Sality.r (v)
K7GW	Virus ( 0008d6051 )
K7AntiVirus	Virus ( 0008d6051 )
Arcabit	Win32.Brontok.EF9751
Invincea	heuristic
Baidu	Win32.Virus.Sality.si
Cyren	W32/Sality.AA
Symantec	W32.Virut.A
TotalDefense	Win32/Sality.O
TrendMicro-HouseCall	PE_SALITY.S
Avast	Win32:Brontok [Wrm]
ClamAV	Win.Trojan.Sality-1017
GData	Win32.Trojan.Rontokbro.A
Kaspersky	Virus.Win32.Sality.p
BitDefender	Win32.Brontok.AP@mm
NANO-Antivirus	Virus.Win32.Sality.fsqo
ViRobot	Win32.Sality.B
AegisLab	Virus.W32.Sality!c
Rising	Virus.Sality!1.A59B (CLASSIC)
Ad-Aware	Win32.Brontok.AP@mm
Emsisoft	Win32.Brontok.AP@mm (B)
Comodo	Virus.Win32.Sality.P
F-Secure	Win32.Brontok.AP@mm
DrWeb	Win32.HLLP.Sector
Zillya	Virus.Sality.Win32.6
TrendMicro	PE_SALITY.S
McAfee-GW-Edition	BehavesLike.Win32.Malware.cm
Sophos	W32/Sality-V
Ikarus	Virus.Win32.Rontokbr.I2
F-Prot	W32/Sality.AA
Jiangmin	Win32/HLLP.Kuku.f
Avira	W32/Virut.Gen
Kingsoft	Win32.Virut.xd.34304
Microsoft	Virus:Win32/Sality.R
Endgame	malicious (high confidence)
SUPERAntiSpyware	Worm.Brontok-A
ZoneAlarm	Virus.Win32.Sality.p
AhnLab-V3	HEUR/Fakon.mwf
McAfee	W32/Rontokbro@MM
AVware	Virus.Win32.Sality.r (v)
MAX	malware (ai score=86)
VBA32	Win32.HLLP.Kuku.307p
Malwarebytes	Worm.Brontok
Panda	W32/Sality.U
Zoner	I-Worm.Brontok.A
ESET-NOD32	Win32/Sality.NAI
Tencent	Trojan.Win32.FakeFolder.v
Yandex	Win32.Sality.W
SentinelOne	static engine – malicious
Fortinet	W32/Sality.P
AVG	Win32:Brontok [Wrm]
Cybereason	malicious.1b8fb7
CrowdStrike	malicious_confidence_100% (D)
Qihoo-360	Virus.Win32.Sality.C