Categories: Worm

Worm:Win32/Lightmoon!pz removal instruction

The Worm:Win32/Lightmoon!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Lightmoon!pz virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Executable file is packed/obfuscated with MPRESS
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Worm:Win32/Lightmoon!pz?


File Info:
name: F71A0A6E94FEBD274D5B.mlwpath: /opt/CAPEv2/storage/binaries/b0dca6d8f2853cc00cc7e7da5d6521028d817254f3aa8fb136509336d99a2163crc32: CAFD4170md5: f71a0a6e94febd274d5bc014f3c65d36sha1: 84710dba63e8e55101a05294d9c83c7aee2ecd0asha256: b0dca6d8f2853cc00cc7e7da5d6521028d817254f3aa8fb136509336d99a2163sha512: 5977968cf39d993e4754e223fa106362b170f30832ce9033a9fa1d272d6686b920440b9bbe9e399ea1f87f910e0114b93b1508138fd12bd6afa80fd869ff21dassdeep: 6144:yY+32WWluqvHpVmXWEjFJRWci+WUd20hUU5EYCTvaBju4zk9Op:hnWwvHpVmXpjJIUd2OUusvalxzk9Optype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1BBA42A3AEB10B126FA578C7A782A4E1615243C3522119E4BB3926B4D38767C3F9F474Fsha3_384: fcd6bf08b8842a7283a394598bd7ae1a8245de2c52dd1b1544dd576078a466781315af86f3c86bda70cf9f664caae443ep_bytes: 680c4d4000e8eeffffff000000000000timestamp: 2007-01-12 10:04:58
Version Info:
Translation: 0x0409 0x04b0Comments: Microsoft CorporationCompanyName: File FolderProductName:  FileVersion: 1.00ProductVersion: 1.00InternalName: FILE FOLDEROriginalFilename: FILE FOLDER.exe

Worm:Win32/Lightmoon!pz also known as:

Bkav	W32.AIDetectMalware
DrWeb	Trojan.DownLoader6.64360
MicroWorld-eScan	DeepScan:Generic.Malware.LMV3!prn!g.EE1407F1
FireEye	Generic.mg.f71a0a6e94febd27
Skyhigh	BehavesLike.Win32.Ramnit.gt
McAfee	W32/MoonLight.worm.b
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	DeepScan:Generic.Malware.LMV3!prn!g.EE1407F1
Sangfor	Trojan.Win32.Save.ShadowBrokersC
K7AntiVirus	Trojan ( 0040f6141 )
BitDefender	DeepScan:Generic.Malware.LMV3!prn!g.EE1407F1
K7GW	Trojan ( 0040f6141 )
Cybereason	malicious.a63e8e
BitDefenderTheta	AI:Packer.764ED5571D
VirIT	Worm.Win32.MoonLight.A
Symantec	W32.Lunalight@mm
Elastic	malicious (high confidence)
ESET-NOD32	Win32/NoonLight.Y
APEX	Malicious
ClamAV	Win.Worm.Moonlight-9775620-0
Kaspersky	Email-Worm.Win32.VB.co
NANO-Antivirus	Trojan.Win32.VB.foifdq
Rising	Worm.VBInjectEx!1.99E6 (CLASSIC)
Emsisoft	DeepScan:Generic.Malware.LMV3!prn!g.EE1407F1 (B)
Google	Detected
F-Secure	Trojan.TR/Moonlight.DLL.yiila
Baidu	Win32.Worm.VB.a
Zillya	Worm.VB.Win32.67990
Trapmine	malicious.high.ml.score
Sophos	W32/Bobandy-I
SentinelOne	Static AI – Malicious PE
Jiangmin	Worm/VB.a
Webroot	W32.Malware.Gen
Varist	W32/Noon.K.gen!Eldorado
Avira	TR/Moonlight.DLL.yiila
MAX	malware (ai score=80)
Antiy-AVL	Virus/Win32.Expiro.imp
Kingsoft	malware.kb.a.1000
Microsoft	Worm:Win32/Lightmoon!pz
Xcitium	TrojWare.Win32.Regrun.Q@1gs3xh
Arcabit	DeepScan:Generic.Malware.LMV3!prn!g.EE1407F1
ZoneAlarm	Email-Worm.Win32.VB.co
GData	DeepScan:Generic.Malware.LMV3!prn!g.EE1407F1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.VBKrypt.R526323
Acronis	suspicious
ALYac	DeepScan:Generic.Malware.LMV3!prn!g.EE1407F1
DeepInstinct	MALICIOUS
VBA32	TScope.Trojan.VB
Cylance	unsafe
Panda	W32/Moonlight.P.worm
Zoner	Trojan.Win32.77489
Tencent	Worm.Win32.Vb.wao
Yandex	Worm.NoonLight!yraM5LGj/Aw
Ikarus	Trojan.Win32.Patched
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Moonlight.B!worm
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_100% (W)