Worm:Win32/Esfury malicious file

Malware Removal

The Worm:Win32/Esfury is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Worm:Win32/Esfury virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (22 unique times)
  • Reads data out of its own binary image
  • Attempts to modify Internet Explorer’s start page
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Spanish (Peru)
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Executed a process and injected code into it, probably while unpacking
  • Steals private information from local Internet browsers
  • A system process is generating network traffic likely as a result of process injection
  • Network activity contains more than one unique useragent.
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Operates on local firewall’s policies and settings
  • Creates a copy of itself
  • Attempts to disable System Restore
  • Attempts to disable UAC
  • The sample wrote data to the system hosts file.
  • Attempts to modify or disable Security Center warnings
  • Attempts to modify UAC prompt behavior
  • Anomalous binary characteristics
  • Attempts to modify Explorer settings to prevent file extensions from being displayed
  • Attempts to modify Explorer settings to prevent hidden files from being displayed

Related domains:

z.whorecord.xyz
a.tomx.xyz
whos.amung.us
widgets.amung.us
c.statcounter.com
ocsp.comodoca.com
ocsp.usertrust.com
ocsp.sectigo.com
sstatic1.histats.com
7d4yo3zub87u618930o9ol28l6808v.ipcheker.com
9756ru97o528l6t6gd96w2367d308n.ipgreat.com
0ko9r56bn6147b3clxdjilvudt602j.ipcheker.com
w3344va8bccr3s17eizon7258vr69s.ipgreat.com
3xu2h68yhv860dfaa45w2bamaws4d6.ipcheker.com
q72pxwr1d7g4fb4kkq52z4a91k473u.ipgreat.com
4z17j3o709638j13yt9ery717eu04i.ipcheker.com
dfv1c1snva0c60r5dg2954yn8lyvim.ipgreat.com
qc7n00q95q1p9538f7r62x5r45crw1.ipcheker.com
7m7vbc3n1313g840f8hh83vh846v33.ipgreat.com
8996lvgoxr24pu220kd628wev88jmw.ipcheker.com
5edfwer8celppf7xvtdb7049eup1fv.ipgreat.com
d2l1r2z413fhv4i.directorio-w.com
vez4p46pfo074q4mlaa0xsrbd3u1if.ipcheker.com
58346ws25b3g6nkfwz1zqj8730z0rm.ipgreat.com
794016nf7q2pouw3u2z6wf0qcc9ig0.ipcheker.com
7085r9j321w264ezy19nr311dv48m9.ipgreat.com
www.bing.com
www.directorio-w.com
0nko36i67p6149n79u43a19b38bm34.ipcheker.com
5x9oa0jfzyse8x11xe68f1l5n911i8.ipgreat.com
www6.directorio-w.com
22iza8ke2hynlicn8op9d1b5yusoo5.ipcheker.com
pk9n5x979w413za1b6l5j69d3w8c64.ipgreat.com
www.qseach.com
www.hugedomains.com
ocsp.pki.goog
ocsp.digicert.com
cdn.jsdelivr.net
static.hugedomains.com
fonts.googleapis.com
use.typekit.net
www.googletagmanager.com
ocsp.globalsign.com
fonts.gstatic.com
8frjc0cdxx143k239t0f1mu7rg5786.ipcheker.com
78b3a965vui5p25s9y78i537yedu5j.ipgreat.com
www.google-analytics.com
www.youtube.com
vxqe32b1kaa5lry7gto2t0re750t14.ipcheker.com
7b8jf43z2976759rhso4bt39261tp6.ipgreat.com
gz.symcd.com

How to determine Worm:Win32/Esfury?


File Info:

crc32: 1F6B70E0
md5: a8e7a9ab838e2cdd2d7a2f4dd49af190
name: A8E7A9AB838E2CDD2D7A2F4DD49AF190.mlw
sha1: 8058431ccd946d4586923c5976bc4e13c1bf2f19
sha256: 4de9d63fb103eb2eae99d9428c35597ed20f8e354cec8c899738a8a5c2d9391f
sha512: 89067d81e4a080200c1879a2db59c2f06cbef898a36ebec84fe1485f17a10f09147ccc6d76de8d1cdd43c70584c4e78f052b6660e21e4bbc05c3347016ab071c
ssdeep: 1536:JNhENNo2oa5pHwAVvu0IysOPv3YdI3EpCK+V5iR/yKoDn66XujshkGXE7rFKh:JgN5ogyJ0XgdsEIKlyKo26Jkj7rF
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Worm:Win32/Esfury also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Barys.5460
FireEyeGeneric.mg.a8e7a9ab838e2cdd
ALYacGen:Variant.Barys.5460
CylanceUnsafe
VIPREWorm.Win32.Autorun.vbxw (v)
SangforTrojan.Win32.Save.a
K7AntiVirusP2PWorm ( 001eebf51 )
BitDefenderGen:Variant.Barys.5460
K7GWP2PWorm ( 001eebf51 )
Cybereasonmalicious.b838e2
BitDefenderThetaGen:NN.ZexaF.34590.uqZ@amL3SeO
CyrenW32/Injector.AN.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/AutoRun.VB.XW
APEXMalicious
AvastWin32:Sality [Inf]
ClamAVWin.Trojan.ZedoPoo-1
KasperskyTrojan-Ransom.Win32.ZedoPoo.aak
NANO-AntivirusTrojan.Win32.Trojan-Ransom.vkekr
ViRobotTrojan.Win32.A.ZedoPoo.682160
Ad-AwareGen:Variant.Barys.5460
SophosMal/Generic-S + Troj/Ransom-MT
ComodoTrojWare.Win32.Ransom.ZedoPoo.AAK@4pezqf
F-SecureTrojan.TR/Patched.Ren.Gen
DrWebTrojan.Siggen4.14213
TrendMicroTROJ_ZEDPOOP.SM
McAfee-GW-EditionBehavesLike.Win32.Virut.fz
EmsisoftGen:Variant.Barys.5460 (B)
IkarusTrojan-Ransom.ZedoPoo
JiangminTrojan/ZedoPoo.cs
AviraTR/Patched.Ren.Gen
MAXmalware (ai score=89)
Antiy-AVLTrojan[Ransom]/Win32.ZedoPoo
MicrosoftWorm:Win32/Esfury
ArcabitTrojan.Barys.D1554
SUPERAntiSpywareTrojan.Agent/Gen-Ransom
AhnLab-V3Trojan/Win32.Jorik.R37432
ZoneAlarmTrojan-Ransom.Win32.ZedoPoo.aak
GDataGen:Variant.Barys.5460
CynetMalicious (score: 100)
TotalDefenseWin32/Inject.PDTQOWB
Acronissuspicious
McAfeeRansom-AAI
TACHYONTrojan/W32.Ransom.330928
VBA32BScope.Adware.Softpulse
MalwarebytesMalware.AI.4069801049
PandaGeneric Malware
TrendMicro-HouseCallTROJ_ZEDPOOP.SM
RisingRansom.ZedoPoo!8.1FE8 (CLOUD)
YandexTrojan.GenAsa!RA10aK0Wuo4
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_99%
FortinetW32/ZedoPoo.ABJ!tr
WebrootW32.Trojan.Gen
AVGWin32:Sality [Inf]
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_80% (D)
Qihoo-360Win32/Trojan.Ransom.408

How to remove Worm:Win32/Esfury?

Worm:Win32/Esfury removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment