Categories: Worm

How to remove “Worm:Win32/Emerleox.J”?

The Worm:Win32/Emerleox.J is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Emerleox.J virus can do?

At least one process apparently crashed during execution
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Arabic
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Executable file is packed/obfuscated with NsPack
The executable is likely packed with VMProtect
Authenticode signature is invalid

How to determine Worm:Win32/Emerleox.J?


File Info:
name: 286DCB3E915B158D8137.mlwpath: /opt/CAPEv2/storage/binaries/5987d0c969cdbb731136789a09d2d37c9c67afbc282109437a7953f7bfb00c5dcrc32: 0D7CF4DCmd5: 286dcb3e915b158d8137bb822a00e83csha1: 0173f6a4a6952be684053813938413af70f01ccdsha256: 5987d0c969cdbb731136789a09d2d37c9c67afbc282109437a7953f7bfb00c5dsha512: c427cc62fd64f3f54e59822ff648374688b68fc9b22140ac375072e8a82ce3c24a8b5dbf5390f1521f6b0f8164e356f4039b37c4cc058e9a3dc6b349466259fdssdeep: 12288:pmeAQqTIVxP8LGPvmbITjkecHPraVmoSAjidA9q+46hKu9AZGFGVMP:pmebqTIVxPJP+bKkecHPraVlSAjia863type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T117D423436246F0D8EF607EB49DA210F9E7989C80C825FC1499EB3D9332B1ED3A575B91sha3_384: 9d3d6553a9bd472882302385b53de399e99fa9f8e52d93aca68cac22c685723dc340fcc3df065bf80cd69697ec957244ep_bytes: 686eb76700e86a010000668b0683eefetimestamp: 2007-06-18 13:30:26
Version Info:
0: [No Data]

Worm:Win32/Emerleox.J also known as:

Lionic	Trojan.Win32.Hupigon.lmEa
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader7.16196
MicroWorld-eScan	Packer.Malware.VPacker.B
FireEye	Generic.mg.286dcb3e915b158d
ALYac	Packer.Malware.VPacker.B
Cylance	Unsafe
Zillya	Backdoor.Hupigon.Win32.100091
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
K7GW	Trojan ( 005257651 )
K7AntiVirus	Trojan ( 005257651 )
BitDefenderTheta	AI:Packer.D4A0E8A825
Cyren	W32/Trojan.GSZN-2162
Symantec	ML.Attribute.HighConfidence
Zoner	Probably Heur.ExeHeaderP
TrendMicro-HouseCall	BKDR_HUPIGON.EVG
ClamAV	Win.Trojan.Crypted-2
Kaspersky	Packed.Win32.Klone.af
BitDefender	Packer.Malware.VPacker.B
NANO-Antivirus	Trojan.Win32.NSPM.bavygt
Ad-Aware	Packer.Malware.VPacker.B
Emsisoft	Packer.Malware.VPacker.B (B)
Comodo	Malware@#p2beg7tecttb
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	BKDR_HUPIGON.EVG
McAfee-GW-Edition	BehavesLike.Win32.Trickbot.jc
Sophos	ML/PE-A + Mal/EncPk-AE
GData	Packer.Malware.VPacker.B
eGambit	Unsafe.AI_Score_100%
Avira	TR/Crypt.NSPM.Gen
ZoneAlarm	Packed.Win32.Klone.af
Microsoft	Worm:Win32/Emerleox.J
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/MulPacked.Gen
McAfee	Generic Malware.em
MAX	malware (ai score=84)
Malwarebytes	Trojan.MalPack.NSPack
Panda	Trj/Genetic.gen
APEX	Malicious
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazr30+LRAurOCLPRnS81+r02)
Yandex	Trojan.Agent!Dn9OA5f+fgQ
SentinelOne	Static AI – Malicious PE
MaxSecure	Poly.Trojan.Klone.Af
Fortinet	W32/PEMask.A!tr
Webroot	Worm:Win32/Emerleox.J
AVG	Win32:Susn-U [Trj]
Cybereason	malicious.e915b1
Avast	Win32:Susn-U [Trj]