Categories: Worm

Worm:Win32/Fesber.A removal tips

The Worm:Win32/Fesber.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Fesber.A virus can do?

Dynamic (imported) function loading detected
Yara rule detections observed from a process memory dump/dropped files/CAPE
Anomalous file deletion behavior detected (10+)
Attempts to connect to a dead IP:Port (202 unique times)
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Installs itself for autorun at Windows startup
Exhibits possible ransomware file modification behavior
Creates a copy of itself
Anomalous binary characteristics

How to determine Worm:Win32/Fesber.A?


File Info:
name: 2F095B4C39D25CED5EBB.mlwpath: /opt/CAPEv2/storage/binaries/118b81eed20b7b07d98dd13d1ce8af868223258a30ec4c8fbfbfce6baa16fac8crc32: 407391F2md5: 2f095b4c39d25ced5ebbe77601ca8499sha1: 4b8f0593a271e520d915603cb759a2c5b5c9a16dsha256: 118b81eed20b7b07d98dd13d1ce8af868223258a30ec4c8fbfbfce6baa16fac8sha512: 140c6c14a6bea9887cdc02929ef0b455c2e8e5b1c6581783f7fe76b81486effb76687187911094b5779a030201b4a96289e8f793122d99283afe5bf657ccc1f1ssdeep: 12288:I28PZT3YZ9okuA9oBSrnAfCp2kodolCKu1c:jJZua9ob7ko+lCKu1type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1FAB46B1EF7AC54F5D026917C8996C24AF6B2B8301F5196CB2260833E7F37AE45E39B11sha3_384: abd4b94e08174843dbbd44ceb827d21dddb5bac1154895ceacc3f1c93c11a8d6d4c5d4c4d1b31cbb4c2de979064b34d0ep_bytes: 558bec83c4ec33c08945ecb8208c4000timestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

Worm:Win32/Fesber.A also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Wabot.lh0Z
Elastic	malicious (high confidence)
DrWeb	Win32.HLLW.FSB
MicroWorld-eScan	Dropped:Trojan.GenericKD.31231822
FireEye	Generic.mg.2f095b4c39d25ced
McAfee	W32/Keco.worm.gen
Cylance	Unsafe
Zillya	Backdoor.Delf.Win32.19961
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004bcce41 )
Alibaba	Backdoor:Win32/LunaStorm.584eee3c
K7GW	Trojan ( 004bcce41 )
Cybereason	malicious.c39d25
BitDefenderTheta	AI:Packer.128895A320
Cyren	W32/Delfloader.B.gen!Eldorado
Symantec	W32.HLLP.Yero.Worm.dr
ESET-NOD32	a variant of Win32/LunaStorm.D
TrendMicro-HouseCall	WORM_YERO.A
Paloalto	generic.ml
ClamAV	Win.Worm.Fesber-9939367-0
Kaspersky	Backdoor.Win32.Delf.lz
BitDefender	Dropped:Trojan.GenericKD.31231822
NANO-Antivirus	Trojan.Win32.Fesber.fjhfvl
Avast	Win32:Agent-AVCC [Trj]
Tencent	Malware.Win32.Gencirc.10d0197b
Ad-Aware	Dropped:Trojan.GenericKD.31231822
Emsisoft	Dropped:Trojan.GenericKD.31231822 (B)
Comodo	TrojWare.Win32.TrojanDownloader.Delf.gen@1xqow5
Baidu	Win32.Trojan-Dropper.Agent.ad
TrendMicro	WORM_YERO.A
McAfee-GW-Edition	BehavesLike.Win32.HLLP.hm
Sophos	Mal/Generic-R
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor/Delf.bwp
MaxSecure	Trojan.Malware.1943155.susgen
Avira	WORM/Fesber
MAX	malware (ai score=80)
Antiy-AVL	Worm/Win32.Fesber.g
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Worm:Win32/Fesber.A
ZoneAlarm	Backdoor.Win32.Delf.lz
GData	Dropped:Trojan.GenericKD.31231822
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Xema.C35566
Acronis	suspicious
VBA32	BScope.Backdoor.Agent
ALYac	Dropped:Trojan.GenericKD.31231822
Malwarebytes	Malware.AI.3569880061
APEX	Malicious
Rising	Worm.Win32.Fesber.e (CLOUD)
Yandex	Trojan.GenAsa!rbAcHlWfCJ4
eGambit	Generic.Malware
Fortinet	W32/Delf.NRF!tr
AVG	Win32:Agent-AVCC [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (W)