Categories: Worm

What is “Worm:Win32/Lightmoon!pz”?

The Worm:Win32/Lightmoon!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Lightmoon!pz virus can do?

Behavioural detection: Executable code extraction – unpacking
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Yara detections observed in process dumps, payloads or dropped files

How to determine Worm:Win32/Lightmoon!pz?


File Info:
name: 9D9B2EC95D94DDBEA545.mlwpath: /opt/CAPEv2/storage/binaries/245f91133c2cb0c06c3115356048803b483dd98b9f87fcb4cc3970bf29223f51crc32: 623D857Cmd5: 9d9b2ec95d94ddbea545cd663de9dbaasha1: 30a00f2f85d2498042990307e57e696abf418048sha256: 245f91133c2cb0c06c3115356048803b483dd98b9f87fcb4cc3970bf29223f51sha512: d95efbf65795479a599200e633b5b480a7fc765a07e34e30c07593a0c4d5a91792b0c3eacb6ac9452bf27d05cf9e81f7c7c3cb58d8f5a3f9acea08523c163b4cssdeep: 768:8W9+knfeU3D7qiayUQNtgjCUmWAteITPzTLlq9mQZmuXChDZ+6Z3DL+B5nHguULX:L+LwD+ragjvWeInk1m8pfgfMeftype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T12F04A606234A9449E673893C3E6685B211B37D645F3B83D9395FF13A1EBBE125C29B03sha3_384: 28e9ecf393e8d80e2a146f516b9dfa18dd26091612b6d35515a39d9c7376f792961775dd942857f5488abd46bf578de5ep_bytes: 6820144000e8eeffffff000000000000timestamp: 2004-03-08 01:57:36
Version Info:
Translation: 0x0409 0x04b0Comments: Microsoft CorporationCompanyName: FileFolderProductName: Project1FileVersion: 1.00ProductVersion: 1.00InternalName: MoonlightOriginalFilename: Moonlight.exe

Worm:Win32/Lightmoon!pz also known as:

Bkav	W32.AIDetectMalware
Lionic	Worm.Win32.VB.tnt4
MicroWorld-eScan	Generic.Malware.SLacHV!hid!!prn!g.CC246AC0
ClamAV	Win.Worm.Moonlight-6932558-0
FireEye	Generic.mg.9d9b2ec95d94ddbe
CAT-QuickHeal	Worm.Lightmoon.MF.213
Skyhigh	BehavesLike.Win32.Generic.cz
McAfee	W32/MoonLight.worm.b
Cylance	unsafe
Zillya	Worm.VB.Win32.65
Sangfor	Suspicious.Win32.Save.vb
K7AntiVirus	Trojan ( 004be95d1 )
Alibaba	Worm:Win32/Lightmoon.638447f4
K7GW	Trojan ( 004be95d1 )
Cybereason	malicious.f85d24
Baidu	Win32.Worm.VB.a
VirIT	Worm.Win32.VB.FDY
Symantec	W32.Rontokbro@mm
Elastic	malicious (high confidence)
ESET-NOD32	Win32/NoonLight.B
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Worm.Win32.VB.cz
BitDefender	Generic.Malware.SLacHV!hid!!prn!g.CC246AC0
NANO-Antivirus	Trojan.Win32.VB.bunnt
SUPERAntiSpyware	Trojan.Agent/Generic
Avast	Win32:VB-AMC [Wrm]
Emsisoft	Generic.Malware.SLacHV!hid!!prn!g.CC246AC0 (B)
F-Secure	Worm.WORM/VB.CZ.14.A
DrWeb	Worm.Siggen.6379
VIPRE	Generic.Malware.SLacHV!hid!!prn!g.CC246AC0
TrendMicro	WORM_VB.KEU
Sophos	W32/Bobandy-D
Ikarus	Worm.Win32.Lightmoon
GData	Generic.Malware.SLacHV!hid!!prn!g.CC246AC0
Jiangmin	Worm/VB.qel
Webroot	W32.Worm.Gen
Google	Detected
Avira	WORM/VB.CZ.14.A
Antiy-AVL	Worm/Win32.VB
Kingsoft	Win32.HeurC.KVM007.a
Xcitium	Worm.Win32.VB.wdr@2nrss7
Arcabit	Generic.Malware.SLacHV!hid!!prn!g.CC246AC0
ViRobot	Worm.Win32.A.VB.131072.B
ZoneAlarm	Worm.Win32.VB.cz
Microsoft	Worm:Win32/Lightmoon!pz
Varist	W32/VB-Backdoor-PEK-based!Maxim
AhnLab-V3	Trojan/Win32.HDC.C103531
Acronis	suspicious
VBA32	TScope.Trojan.VB
ALYac	Generic.Malware.SLacHV!hid!!prn!g.CC246AC0
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware.AI.DDS
Panda	W32/Moonlight.A.worm
TrendMicro-HouseCall	WORM_VB.KEU
Rising	Worm.Lightmoon!1.9D93 (CLASSIC)
Yandex	Trojan.GenAsa!W0jrCu6jlZw
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/MoonLight!worm
BitDefenderTheta	AI:Packer.2ACFB57F1D
AVG	Win32:VB-AMC [Wrm]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)