Categories: Worm

What is “Worm:Win32/Duptwux.A”?

The Worm:Win32/Duptwux.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Duptwux.A virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Unconventionial language used in binary resources: Turkish
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Operates on local firewall’s policies and settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Worm:Win32/Duptwux.A?


File Info:
crc32: 235A85CBmd5: 0f4470c9420900b42bd249ba438f68f3name: 0F4470C9420900B42BD249BA438F68F3.mlwsha1: 9c9ba954fe03d4718880f694476db01d90dda4bfsha256: e0a53f10201ced7aba365c7fd288a198d7fe414f074d8f00979be73bde2d8cf1sha512: c2a3180ec9fc8a4e27382c8dc82db90074f17e8bcde5477eb42ca05bd6f23a98f4bce1a791f611fca83aeb58973acaa9ab0d6001b8282bbe8545e9c81f6961eessdeep: 24576:lLnaj7ySWIq2wfrx+P4TbTq/aA8ttknGTE8vlj+9A3SvGIGV/wgMGsTAo:FELq3Dk4nWi8MEUlhcGp/wgEkotype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Worm:Win32/Duptwux.A also known as:

K7AntiVirus	Trojan ( 0055e3df1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.MulDrop2.21746
Cynet	Malicious (score: 100)
ALYac	Gen:Trojan.Heur.ZHZ@t5VLJ@dGb
Cylance	Unsafe
Zillya	Trojan.Swisyn.Win32.20892
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Ransom:Win32/Blocker.15113860
K7GW	Trojan ( 0055e3df1 )
Cybereason	malicious.942090
Cyren	W32/Risk.FRQL-2013
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDropper.Binder.NBD
APEX	Malicious
Avast	Win32:Dropper-FXE [Drp]
ClamAV	Win.Trojan.Agent-1103185
Kaspersky	Trojan-Ransom.Win32.Blocker.ftnk
BitDefender	Gen:Trojan.Heur.ZHZ@t5VLJ@dGb
NANO-Antivirus	Trojan.Win32.Swisyn.dvqwm
MicroWorld-eScan	Gen:Trojan.Heur.ZHZ@t5VLJ@dGb
Tencent	Win32.Trojan.Blocker.Hfg
Ad-Aware	Gen:Trojan.Heur.ZHZ@t5VLJ@dGb
Sophos	Mal/Generic-S + Troj/Pasta-D
Comodo	Suspicious@#1io11371abnh1
BitDefenderTheta	AI:Packer.3701DEB01D
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_Blocker.R002C0DE621
McAfee-GW-Edition	BehavesLike.Win32.Worm.tc
FireEye	Generic.mg.0f4470c9420900b4
Emsisoft	Gen:Trojan.Heur.ZHZ@t5VLJ@dGb (B)
SentinelOne	Static AI – Suspicious PE
Webroot	W32.Trojan.Dynamer
Avira	HEUR/AGEN.1107671
Kingsoft	Win32.Troj.Generic.(kcloud)
Microsoft	Worm:Win32/Duptwux.A
Arcabit	Trojan.Heur.EA7EFB
GData	Gen:Trojan.Heur.ZHZ@t5VLJ@dGb
McAfee	Artemis!0F4470C94209
MAX	malware (ai score=100)
VBA32	Trojan.Swisyn
Panda	Generic Malware
TrendMicro-HouseCall	Ransom_Blocker.R002C0DE621
Rising	Ransom.Blocker!8.12A (CLOUD)
Yandex	Trojan.GenAsa!hj/WDV+IcSI
Ikarus	Trojan.Win32.Pasta
Fortinet	W32/LolBot.OH!tr.bdr
AVG	Win32:Dropper-FXE [Drp]
Paloalto	generic.ml