Worm:Win32/Renocide information

Malware Removal

The Worm:Win32/Renocide is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Worm:Win32/Renocide virus can do?

  • Reads data out of its own binary image
  • Unconventionial binary language: Bulgarian
  • Unconventionial language used in binary resources: Bulgarian
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Creates an autorun.inf file
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Worm:Win32/Renocide?


File Info:

crc32: 3F430727
md5: fe564b38c789b6e5b0e3865f010836ed
name: FE564B38C789B6E5B0E3865F010836ED.mlw
sha1: 88a913c0d89cea63bf22335b84098efb00d5cafe
sha256: 34a46109c08f816149be686a6ed877e1bbd0352d04af02cf662430b32cd69161
sha512: 41ea76d5856593215e4050edecbd6d89b53466a36297f6651b44f451081641b1c1731c6b920710ad68ed23f52aaa4de731a943ef031a950ecf58bf0ba0b2686c
ssdeep: 12288:SnNhuBoY8SorxgmA+nlvVlfLVRA5iqAfAne5iFA8XXXezP+Rf/7glcE2q:SPatCg7EPVVm5nrX++RfklcTq
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

LegalCopyright: PIKS3323PW51Z45OAREZWGUE
FileVersion: 997.60.100.74
Comments: NXNI792923SE51Z45CKBGMUOZO
FileDescription: MXHX974323EM51A45ZHZWRVKUN
Translation: 0x0402 0x04b0

Worm:Win32/Renocide also known as:

BkavW32.OtranQKA.Fam.Worm
DrWebWin32.HLLW.Autoruner.based
CynetMalicious (score: 99)
CAT-QuickHealWorm.AutoIt.Harakit.A
ALYacGen:Trojan.Heur.AutoIT.4
CylanceUnsafe
ZillyaWorm.AutoIt.Win32.5790
SangforWorm.Win32.Renocide.mt
CrowdStrikewin/malicious_confidence_90% (W)
Cybereasonmalicious.8c789b
SymantecW32.Harakit
ESET-NOD32multiple detections
APEXMalicious
AvastWin32:Malware-gen
ClamAVWin.Trojan.Autoit-142
KasperskyTrojan-Ransom.Win32.PornoAsset.dkpe
BitDefenderGen:Trojan.Heur.AutoIT.4
NANO-AntivirusTrojan.Script.AutoIt.flxjdb
MicroWorld-eScanGen:Trojan.Heur.AutoIT.4
TencentMalware.Win32.Gencirc.10b3a7f8
Ad-AwareGen:Trojan.Heur.AutoIT.4
SophosMal/Tiotua-C
BitDefenderThetaAI:Packer.ADE5CE5E18
VIPRETrojan.Win32.Generic!BT
TrendMicroMal_Otorun-13
McAfee-GW-EditionBehavesLike.Win32.Dropper.jc
FireEyeGeneric.mg.fe564b38c789b6e5
EmsisoftGen:Trojan.Heur.AutoIT.4 (B)
JiangminTrojan/Midgare.fou
WebrootW32.Trojan.Gen
AviraTR/Dropper.Gen2
eGambitUnsafe.AI_Score_96%
KingsoftWorm.AutoIt.xl.(kcloud)
MicrosoftWorm:Win32/Renocide
GDataGen:Trojan.Heur.AutoIT.4
McAfeeArtemis!FE564B38C789
MAXmalware (ai score=83)
VBA32Trojan.Tiggre
MalwarebytesMalware.AI.2386024760
PandaTrj/CI.A
TrendMicro-HouseCallMal_Otorun-13
IkarusWorm.Win32.AutoIt
FortinetW32/AutoIt.RN!tr
AVGWin32:Malware-gen
Qihoo-360Win32/Worm.afd

How to remove Worm:Win32/Renocide?

Worm:Win32/Renocide removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment