Categories: Worm

Worm:Win32/Citeary.E removal

The Worm:Win32/Citeary.E is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Citeary.E virus can do?

Creates RWX memory
Loads a driver
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
A process created a hidden window
Uses Windows utilities for basic functionality
Attempts to stop active services
A process attempted to delay the analysis task by a long amount of time.
Installs itself for autorun at Windows startup
Exhibits possible ransomware file modification behavior
Creates a hidden or system file
Attempts to modify proxy settings
Creates a copy of itself
Anomalous binary characteristics

Related domains:

trt10.t3egc.com

How to determine Worm:Win32/Citeary.E?


File Info:
crc32: 08035AC3md5: adbb8d3676e0cc442b6faea30266810ename: ADBB8D3676E0CC442B6FAEA30266810E.mlwsha1: 29f565301a2cb2593a63f4a1a56575b89552b00bsha256: c60551032968a12519001c7b2610efe4ed8a059021f0b05772ca13ff621a09besha512: 2b0cb6102781961840fa44ae0187eb38c8a5c86b9843a57354ba932ce4f347b52e3a71e2431299a0266b625ed8e355a329bba240f50089f966022dab13376905ssdeep: 12288:CH+7EjQdrOtYJ+60LcaXvHiWTeJBFakGLxmM54U:CwEsQi460AaXPziBF2/5vtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Worm:Win32/Citeary.E also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader9.41620
MicroWorld-eScan	Gen:Variant.Zusy.323129
CMC	Trojan-Dropper.Win32!O
CAT-QuickHeal	Trojan.Small.BP
McAfee	Downloader-BVN.b
Cylance	Unsafe
VIPRE	Trojan-Spy.Win32.Agent.dcbd (v)
Sangfor	Malware
K7AntiVirus	Trojan-Downloader ( 0016e9d81 )
BitDefender	Gen:Variant.Zusy.323129
K7GW	Trojan-Downloader ( 0016e9d81 )
Cybereason	malicious.676e0c
BitDefenderTheta	AI:Packer.7159AFA71E
Cyren	W32/KillAV.AF.gen!Eldorado
Symantec	W32.SillyDC
APEX	Malicious
Avast	Win32:Geral [Trj]
ClamAV	Win.Trojan.KillAV-47
NANO-Antivirus	Trojan.Win32.Agent.bqmqd
Tencent	Malware.Win32.Gencirc.10b6dfbf
Ad-Aware	Gen:Trojan.Heur.RP.FqZ@bqRS!jl
Sophos	ML/PE-A
Comodo	TrojWare.Win32.PSW.GamePass.B@2mkvnt
F-Secure	Worm.WORM/Citeary.dou
Baidu	Win32.Backdoor.Agent.n
Zillya	Downloader.Agent.Win32.68300
TrendMicro	TROJ_FAKEAV.SMB1
McAfee-GW-Edition	BehavesLike.Win32.Autorun.hc
Ikarus	Worm.Win32.Citeary
GData	Gen:Variant.Zusy.323129
Jiangmin	TrojanDownloader.Agent.cgkm
Avira	WORM/Citeary.dou
Antiy-AVL	Trojan[Dropper]/Win32.Agent.dcbd
Arcabit	Trojan.Zusy.D4EE39
ZoneAlarm	Trojan-Dropper.Win32.Agent.dcbd
Microsoft	Worm:Win32/Citeary.E
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.R125686
Acronis	suspicious
VBA32	BScope.Trojan.Agent
MAX	malware (ai score=81)
Malwarebytes	Trojan.KillAV
Panda	Generic Malware
ESET-NOD32	Win32/TrojanDownloader.Agent.QFO
TrendMicro-HouseCall	TROJ_FAKEAV.SMB1
Rising	Worm.Citeary!1.9EC8 (CLASSIC)
Yandex	Trojan.GenAsa!JtW9G6xrVn8
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Agent.QFO!tr
AVG	Win32:Geral [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	HEUR/QVM20.1.0A87.Malware.Gen