Categories: Worm

Worm:Win32/Lightmoon!pz removal

The Worm:Win32/Lightmoon!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Lightmoon!pz virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Worm:Win32/Lightmoon!pz?


File Info:
name: 8D7C1F91C9914F9F08CC.mlwpath: /opt/CAPEv2/storage/binaries/871b5d451cc585431135b1534f2b5e4427e668310877ea36e50db48d3e043f82crc32: 8C36FFBBmd5: 8d7c1f91c9914f9f08cc12e7ddae2c39sha1: de118b9e1d85caec5fa12c0d2d35b362e5a4d75esha256: 871b5d451cc585431135b1534f2b5e4427e668310877ea36e50db48d3e043f82sha512: bed82adeac477c971dd89d9e89f1777659f2806c7375a078bf5664b9ba59691247e51530d5a7a129c001f07aee10444816eb302f7359ad6212bc9645c3d70f89ssdeep: 6144:3BlY+32WWluqvHpVmXWEjFJRWci+WUd20rUU5EYCTvaBju4z2G2b2Sx:3UnWwvHpVmXpjJIUd2cUusvalxzBY9xtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T12DA42A3AEB10B126FA578C7A78294E1A15283C3522119E4BB3926B4D34767C3F9F474Fsha3_384: a29c3ff7db0e94a4b9033337df0f32003a3ed7b1a4c0e2c0ba8622a9769d3233e5b11fce695f5e29381f917532c9c6d3ep_bytes: 680c4d4000e8eeffffff000000000000timestamp: 2007-01-12 10:04:58
Version Info:
Translation: 0x0409 0x04b0Comments: Microsoft CorporationCompanyName: File FolderProductName:  FileVersion: 1.00ProductVersion: 1.00InternalName: FILE FOLDEROriginalFilename: FILE FOLDER.exe

Worm:Win32/Lightmoon!pz also known as:

Elastic	malicious (moderate confidence)
MicroWorld-eScan	DeepScan:Generic.Malware.LMV3!prn!g.C051BF71
Skyhigh	BehavesLike.Win32.Generic.gm
McAfee	W32/MoonLight.worm.b
Malwarebytes	Generic.Malware.AI.DDS
Zillya	Worm.VB.Win32.63717
Sangfor	Suspicious.Win32.Save.vb
K7AntiVirus	Trojan ( 004bcce41 )
BitDefender	DeepScan:Generic.Malware.LMV3!prn!g.C051BF71
K7GW	Trojan ( 004bcce41 )
CrowdStrike	win/malicious_confidence_100% (W)
Baidu	Win32.Worm.VB.a
VirIT	Trojan.Win32.VB_Heur
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/NoonLight.Y
APEX	Malicious
ClamAV	Win.Worm.Moonlight-9775620-0
Kaspersky	Email-Worm.Win32.VB.co
NANO-Antivirus	Trojan.Win32.VB.foifdq
Rising	Worm.VBInjectEx!1.99E6 (CLASSIC)
Sophos	W32/Bobandy-I
F-Secure	Trojan.TR/Moonlight.DLL.yiila
DrWeb	Trojan.DownLoader6.64360
VIPRE	DeepScan:Generic.Malware.LMV3!prn!g.C051BF71
TrendMicro	WORM_MOONLIGHT.F
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.8d7c1f91c9914f9f
Emsisoft	DeepScan:Generic.Malware.LMV3!prn!g.C051BF71 (B)
Ikarus	Trojan.Win32.Patched
Jiangmin	Worm/VB.a
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/Moonlight.DLL.yiila
Varist	W32/Noon.K.gen!Eldorado
Antiy-AVL	Trojan/Win32.NoonLight
Kingsoft	malware.kb.a.1000
Microsoft	Worm:Win32/Lightmoon!pz
Xcitium	TrojWare.Win32.Regrun.Q@1gs3xh
Arcabit	DeepScan:Generic.Malware.LMV3!prn!g.C051BF71
ZoneAlarm	Email-Worm.Win32.VB.co
GData	DeepScan:Generic.Malware.LMV3!prn!g.C051BF71
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.VBKrypt.R243850
Acronis	suspicious
VBA32	TScope.Trojan.VB
ALYac	DeepScan:Generic.Malware.LMV3!prn!g.C051BF71
MAX	malware (ai score=86)
DeepInstinct	MALICIOUS
Cylance	unsafe
Panda	W32/Moonlight.P.worm
Zoner	Trojan.Win32.77489
TrendMicro-HouseCall	WORM_MOONLIGHT.F
Tencent	Email-Worm.Win32.Vb.c
Yandex	I-Worm.VB.ZUF
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Moonlight.B!worm
BitDefenderTheta	AI:Packer.18D87A541D
AVG	Win32:Trojan-gen
Cybereason	malicious.e1d85c
Avast	Win32:Trojan-gen