About “Worm:Win32/Gamarue.N” infection

The Worm:Win32/Gamarue.N is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Worm:Win32/Gamarue.N virus can do?

Sample contains Overlay data
Authenticode signature is invalid

How to determine Worm:Win32/Gamarue.N?


File Info:
name: 9E109DAB1079E22D94AB.mlw
path: /opt/CAPEv2/storage/binaries/4cf341d879953cac1683f7d42d3fa47436482ab623688f4919aa9649f60f646f
crc32: 07A3957F
md5: 9e109dab1079e22d94abe6eec9e2fa50
sha1: 7a2df153afcb6499909f900379169b372be226e1
sha256: 4cf341d879953cac1683f7d42d3fa47436482ab623688f4919aa9649f60f646f
sha512: 421b4f46a803b3bce9abfaea6c1859710aaad9f670e1c1b396da56fb50de2b946fbd1e1cb228dbfad10c14b10a5bd0ec8bbaf036ee6cfc3711c0447ef43da489
ssdeep: 24:eNGS5k4V4s3Ce89XF/QPVGRVtY44MBgCF1ri1/pNvxZu7cwVIaHYRXc8uSlpa5Ca:a5zdM1cSTBg0r27vTuAEK93P150RUoLr
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T16D912B5BE36417F3D0B82737AEC721DA34B96B302B65860E5055231D18950277C78E33
sha3_384: 4ebdfacfa11774ea2aa1dd9d15c74d8a64bb8a8c4f83a71058338c636e57b17168a9a92cd6d657c76ab3c823de289dd2
ep_bytes: 558bec538b5d08568b750c578b7d1085
timestamp: 2013-04-14 16:51:54

Version Info:
0: [No Data]

Worm:Win32/Gamarue.N also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
DrWeb	Trojan.MulDrop5.33333
MicroWorld-eScan	Gen:Variant.Barys.431082
ClamAV	Win.Worm.Debris-2
FireEye	Generic.mg.9e109dab1079e22d
CAT-QuickHeal	Trojan.Agent.WL
Skyhigh	BehavesLike.Win32.Worm.xt
McAfee	W32/Worm-FHZ!9E109DAB1079
Cylance	unsafe
Zillya	Worm.Debris.Win32.540717
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Worm:Win32/Debris.57ced8be
K7GW	Trojan ( 0049ef861 )
K7AntiVirus	Trojan ( 0049ef861 )
Arcabit	Trojan.Barys.D693EA
BitDefenderTheta	Gen:NN.ZedlaF.36680.aq5@ay!x8bj
VirIT	Worm.Win32.Generic.FAC
Symantec	W32.Dromedan
ESET-NOD32	Win32/Bundpil.W
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Worm.Win32.Debris.b
BitDefender	Gen:Variant.Barys.431082
NANO-Antivirus	Trojan.Win32.Drop.bqofzc
Avast	Win32:Gamarue-BS [Wrm]
Tencent	Trojan.Win32.Csyr.A
Emsisoft	Gen:Variant.Barys.431082 (B)
F-Secure	Trojan.TR/Downloader.Gen
Baidu	Win32.Worm.Bundpil.ae
VIPRE	Gen:Variant.Barys.431082
TrendMicro	WORM_GAMARUE.SMB
Sophos	Troj/Bundpil-C
Ikarus	Worm.Win32.Gamarue
Jiangmin	Trojan/Generic.avopw
Webroot	W32.Worm.Gen
Google	Detected
Avira	TR/Downloader.Gen
Antiy-AVL	Worm/Win32.Debris
Kingsoft	Win32.Worm.Debris.b
Xcitium	Worm.Win32.BundPil.LAS@4woog5
Microsoft	Worm:Win32/Gamarue.N
ViRobot	Worm.Win32.Gamarue.4057
ZoneAlarm	Worm.Win32.Debris.b
GData	Win32.Trojan.PSE.1Y5UO7M
Varist	W32/Csyr.A!Eldorado
AhnLab-V3	Worm/Win32.Gamarue.R63170
Acronis	suspicious
VBA32	TrojanDropper.Andromeda
ALYac	Gen:Variant.Barys.431082
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Downloader.WKR
TrendMicro-HouseCall	WORM_GAMARUE.SMB
Rising	Worm.Win32.Debris.b (CLASSIC)
Yandex	Trojan.GenAsa!gpxJompsY9Q
SentinelOne	Static AI – Malicious PE
MaxSecure	Worm.Debris.a
Fortinet	W32/Generic.W!tr
AVG	Win32:Gamarue-BS [Wrm]
DeepInstinct	MALICIOUS

How to remove Worm:Win32/Gamarue.N?

Worm:Win32/Gamarue.N removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X