What is “Worm.Win32.Rikihaki.fe”?

The Worm.Win32.Rikihaki.fe is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Worm.Win32.Rikihaki.fe virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Authenticode signature is invalid
Installs itself for autorun at Windows startup

How to determine Worm.Win32.Rikihaki.fe?


File Info:
name: 38AC6C2649E424501C12.mlw
path: /opt/CAPEv2/storage/binaries/b5c082bc9468ad47cec00b832b641c7668c63003193e8a67bec73e893d117046
crc32: C2C5A766
md5: 38ac6c2649e424501c121c477bb0745e
sha1: 3dbdaa3a9795fa121c37c085edc6ddd9166fd226
sha256: b5c082bc9468ad47cec00b832b641c7668c63003193e8a67bec73e893d117046
sha512: 72dd168b62cd2c95a945466c2810e94d4a6f2951241f1b61ecc9f8296399dabfbbdee48e89ae74accf9846de1385f269bd3121e5fe26e667303c7182a25ba2b3
ssdeep: 6144:SNy6C9RXeYbc/2bAbehLQq2UM7Je4kv0HO883Si5/0vX:ReLchLR2UM7A4S0S3S0/0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F0A48E10F662D035F1A302F68EBA82F4A8347E70077944D777D46AAE6B686E4ED35703
sha3_384: 32cd12670b939ae4425a1c661fc4719ada3ddcbb55e94ccc29b7c56e01108b6d55a19cbefbca2a7a5d2d4221cf578565
ep_bytes: 558bece8d82a0100e8030000005dc3cc
timestamp: 2014-06-16 11:09:27

Version Info:
0: [No Data]

Worm.Win32.Rikihaki.fe also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Backdoor.ShadowWali.1
CAT-QuickHeal	Worm.Rikihaki.A4
McAfee	W32/Worm-FYO!38AC6C2649E4
Cylance	Unsafe
K7AntiVirus	Trojan ( 00023ea01 )
K7GW	Trojan ( 00023ea01 )
Cybereason	malicious.649e42
Baidu	Win32.Worm.Agent.fw
VirIT	Trojan.Win32.Agent4.BXTR
Cyren	W32/S-4112289e!Eldorado
Symantec	Trojan.Tinba
ESET-NOD32	Win32/Agent.NPZ
APEX	Malicious
Kaspersky	Worm.Win32.Rikihaki.fe
BitDefender	Gen:Variant.Backdoor.ShadowWali.1
NANO-Antivirus	Trojan.Win32.KillFiles.didhhl
Avast	Win32:Malware-gen
Sophos	ML/PE-A + Mal/Zusy-A
Comodo	Worm.Win32.Rikihaki.A@5sbndo
DrWeb	Trojan.KillFiles.14550
Zillya	Worm.Agent.Win32.28025
TrendMicro	WORM_RIKIHAKI.SM
McAfee-GW-Edition	BehavesLike.Win32.CoinMiner.gh
FireEye	Generic.mg.38ac6c2649e42450
Emsisoft	Gen:Variant.Backdoor.ShadowWali.1 (B)
Ikarus	Worm.Win32.Agent
Avira	HEUR/AGEN.1119489
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Generic.ASMalwS.AAB6CF
Microsoft	Worm:Win32/Rikihaki.A
GData	Gen:Variant.Backdoor.ShadowWali.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.R148972
VBA32	BScope.Trojan.KillFiles
ALYac	Gen:Variant.Backdoor.ShadowWali.1
Malwarebytes	Worm.Agent
TrendMicro-HouseCall	WORM_RIKIHAKI.SM
Rising	Worm.Rikihaki!1.A2F0 (RDMK:cmRtazoGft/pxGxnLZDFNUfRmQen)
Yandex	Worm.Agent!cazTjFK00UQ
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_73%
Fortinet	W32/Agent.NQD!worm
BitDefenderTheta	AI:Packer.0585414E1F
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_70% (D)
MaxSecure	Trojan.Malware.300983.susgen

How to remove Worm.Win32.Rikihaki.fe?

Worm.Win32.Rikihaki.fe removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X