Worm.Macoute.S559150 removal guide

The Worm.Macoute.S559150 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Worm.Macoute.S559150 virus can do?

Authenticode signature is invalid
CAPE detected the Macoute malware family
Anomalous binary characteristics

How to determine Worm.Macoute.S559150?


File Info:
name: 1B70CD9CF09B7420ADD3.mlw
path: /opt/CAPEv2/storage/binaries/357d0713d1c365808662796db420227a01171bab6a6622be778a114ef7472841
crc32: 302B59A9
md5: 1b70cd9cf09b7420add374541a32b3d3
sha1: 431af67d100e4c9036612d9648ad16c918900a05
sha256: 357d0713d1c365808662796db420227a01171bab6a6622be778a114ef7472841
sha512: 47549a4815db518cbb313cc43e87db004b49e8630a7426c697866f20fb4355a81ded4a6990e1d191563b6a8c331a0c539fa4bcc44dd90cb9f3f504891a955a19
ssdeep: 6144:CafsiuvAQ+tTm6cyERSiytj71cLE4jKS6vC6t:/CvAQ+q6ctRt636LfjOD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T187A4AF82EBD340F1D8970F72546BA77F9B324A0E502CDD5AD3942E56AC33323A92E754
sha3_384: abc57ab77cf16baa2ac87d717868ba72b0caef140a0f91779f9f41fee5704ab364c5492042eefa338132fb7b554a71b8
ep_bytes: 586a01e8ec3f0100585ac35557565350
timestamp: 1995-02-26 23:24:20

Version Info:
0: [No Data]

Worm.Macoute.S559150 also known as:

Lionic	Trojan.Win32.Agentb.m9mM
Elastic	malicious (high confidence)
FireEye	Generic.mg.1b70cd9cf09b7420
CAT-QuickHeal	Worm.Macoute.S559150
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
Cyren	W32/A-98aec620!Eldorado
Symantec	ML.Attribute.HighConfidence
Baidu	Win32.Worm.Agent.fl
TrendMicro-HouseCall	PE_VIRUX.S-1
Paloalto	generic.ml
ClamAV	Win.Malware.Zusy-9889629-0
Kaspersky	Virus.Win32.Virut.ce
SUPERAntiSpyware	Worm.PasswordStealer/Variant
Avast	Win32:Dropper-GUP [Drp]
Tencent	Trojan.Win32.Keylogger.aa
Comodo	Heur.Corrupt.PE@1z141z3
TrendMicro	PE_VIRUX.S-1
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.gm
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Scar
GData	Win32.Trojan.PSE.10XMVYJ
Avira	TR/Crypt.XPACK.Gen
MAX	malware (ai score=81)
APEX	Malicious
Microsoft	Worm:Win32/Macoute.A
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Scar.R160138
Acronis	suspicious
Malwarebytes	Trojan.PasswordStealer
Rising	Worm.Macoute!1.A746 (CLASSIC)
Yandex	Trojan.GenAsa!53PMqSgQMYw
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/CoinMiner.CE
AVG	Win32:Dropper-GUP [Drp]
Cybereason	malicious.d100e4
Panda	W32/Sality.AO

How to remove Worm.Macoute.S559150?

Worm.Macoute.S559150 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X