Categories: Worm

Worm:Win32/Fasong!pz removal

The Worm:Win32/Fasong!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Fasong!pz virus can do?

Sample contains Overlay data
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Worm:Win32/Fasong!pz?


File Info:
name: 1C31FD8FC0790DB7A54C.mlwpath: /opt/CAPEv2/storage/binaries/20f7f6bf7fca545058beaffff92988002586d41604855dc4142edcff6c3ba5e9crc32: FB220412md5: 1c31fd8fc0790db7a54ce324924d4fe8sha1: 0f6d2f23aaddc2f42817a7e98f1912523b01b807sha256: 20f7f6bf7fca545058beaffff92988002586d41604855dc4142edcff6c3ba5e9sha512: a6b517b53c8d612852dfbe5e9c4bfa39af2155db7360f108a26907a6a855d84c48def7afc515c6f4914b67d5c1dcdee1293c4d4f97e130d949b3468eca052e69ssdeep: 6144:ra8zeFKrXCeJuDx3OJda+ONYnHyRKXAbZR/fjtxsYVUz8Z8XK+a8zeFj4dVVRV:FzxrXCPx1pY0bZZfjxvcpzV/btype: PE32 executable (DLL) (GUI) Intel 80386, for MS Windowstlsh: T160E48D26F3D08837D2732A3C9D5B97649C2AFEA12D3A15452BF83D4C4F387816926397sha3_384: 1ba96b05f66714e2e66ee4257365c3f59f834fab15abecb61ae1aef60a0af9dbe53a482efe5dff0a66c88c0ebd601efaep_bytes: 807c2408010f857d01000060be004041timestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

Worm:Win32/Fasong!pz also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Graftor.31129
Skyhigh	BehavesLike.Win32.Fasong.jm
McAfee	GenericRXAA-FA!1C31FD8FC079
Malwarebytes	Generic.Malware.AI.DDS
Zillya	Trojan.Lmir.Win32.1
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 7000000f1 )
K7GW	Trojan ( 7000000f1 )
CrowdStrike	win/malicious_confidence_100% (D)
Arcabit	Trojan.Graftor.D7999
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Fasong.H
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Lmir-7595062-0
Kaspersky	Trojan-PSW.Win32.QQPass.7003
BitDefender	Gen:Variant.Graftor.31129
NANO-Antivirus	Trojan.Win32.QQPass.gube
Avast	Win32:Lmir-HJ [Trj]
Tencent	Trojan-PSW.Win32.QQPass.haq
Emsisoft	Gen:Variant.Graftor.31129 (B)
F-Secure	Trojan.TR/ATRAPS.Gen
DrWeb	Trojan.PWS.Legmir.1333
VIPRE	Gen:Variant.Graftor.31129
Sophos	Troj/PWS-BUY
Ikarus	Trojan-PWS.Win32.Lmir
Jiangmin	Trojan/PSW.QQpass.m
Avira	TR/ATRAPS.Gen
Antiy-AVL	Trojan[GameThief]/Win32.Lmir
Xcitium	TrojWare.Win32.PSW.Lmir.~F@fb0qq
Microsoft	Worm:Win32/Fasong!pz
ViRobot	Trojan.Win32.A.PSW-QQPass.509656[UPX]
ZoneAlarm	Trojan-PSW.Win32.QQPass.7003
GData	Win32.Trojan.PSE.1AZ1F8F
Varist	W32/Legendmir.IZFX-3783
AhnLab-V3	Trojan/Win32.Lmirhack.C47602
BitDefenderTheta	AI:Packer.3B88007921
ALYac	Gen:Variant.Graftor.31129
VBA32	Trojan.BHORA.01069
Cylance	unsafe
Panda	Trj/Legmir.AJQ
Rising	Worm.Fasong!1.D14C (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Generic.AC.480!tr
AVG	Win32:Lmir-HJ [Trj]
DeepInstinct	MALICIOUS