Categories: Worm

Worm:Win32/Renocide!C removal

The Worm:Win32/Renocide!C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Renocide!C virus can do?

Sample contains Overlay data
Uses Windows utilities for basic functionality
Reads data out of its own binary image
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Deletes executed files from disk
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Worm:Win32/Renocide!C?


File Info:
name: 8BB4F064DAE4C9D8BB4B.mlwpath: /opt/CAPEv2/storage/binaries/f14dcfbdb218feae1d207b101dc81e4538f5e0089f576d03d11aa92b521543facrc32: CE488202md5: 8bb4f064dae4c9d8bb4b5b9a544b400fsha1: 396f33ba0521b6582c106b1c9c86902926571347sha256: f14dcfbdb218feae1d207b101dc81e4538f5e0089f576d03d11aa92b521543fasha512: 6c5d3705cf454eb0efab91123a7e5c0a92a21812e64d91b4fcb8bc7cf08c991606a2c357ec95c3ade75cb5069161e96869a79553d56f55e051c735ce77666a30ssdeep: 6144:2S1hWUo/S89x+4mfW3PUm0aYR9YoOLsb0IIwiLaAnSjDllYdBGGJAxeV4:X1hWN/DnsW/Um0aYRKoq80IUQZGKw4type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10CB412F5B1C4D5E4E2F7107EBF6689103483FF2148F8564D20996A0EA6B53E170DEA8Bsha3_384: fd52182fef9841c240b6477e7d9ed27072e6e3b9db2ec65de32fe88542ed15c8b7bb0d3b570f1c9e74cf0a91a547d794ep_bytes: 60be007046008dbe00a0f9ff5783cdfftimestamp: 2008-06-12 08:51:05
Version Info:
FileVersion: 9.8.0.7FileDescription: n/aTranslation: 0x043d 0x04b0

Worm:Win32/Renocide!C also known as:

Lionic	Worm.Win32.AutoIt.l941
MicroWorld-eScan	Gen:Trojan.Heur.AutoIT.1
CAT-QuickHeal	Worm.AutoIt.Renocide.D
Skyhigh	BehavesLike.Win32.Dropper.hc
McAfee	Artemis!8BB4F064DAE4
Malwarebytes	Generic.Malware/Suspicious
Zillya	Backdoor.PePatch.Win32.32213
Sangfor	Worm.Win32.Autoit.V9sk
Alibaba	Worm:Win32/Renocide.11ebdb62
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Heur.AutoIT.1
VirIT	Worm.Win32.AutoRun.KL
Symantec	W32.Harakit
Elastic	malicious (moderate confidence)
ESET-NOD32	Win32/Tifaut.E
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Autoit-142
Kaspersky	Worm.Win32.AutoIt.xl
BitDefender	Gen:Trojan.Heur.AutoIT.1
NANO-Antivirus	Trojan.Script.AutoIt.flxjdb
Avast	Win32:Malware-gen
Tencent	Win32.Worm.Autoit.Jcnw
Sophos	Mal/Renocide-A
F-Secure	Trojan-Downloader:W32/AutoIt.BI
DrWeb	Win32.HLLW.Autoruner.3438
VIPRE	Gen:Trojan.Heur.AutoIT.1
TrendMicro	Mal_OtorunQ
Emsisoft	Gen:Trojan.Heur.AutoIT.1 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Packed.Klone.ebb
Webroot	W32.Malware.Gen
Varist	W32/AutoIt.I.gen!Eldorado
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan[Packed]/Win32.Autoit
Xcitium	Malware@#3b4zspzhxlte
Microsoft	Worm:Win32/Renocide.gen!C
ZoneAlarm	VHO:Worm.Win32.Convagent.gen
GData	Gen:Trojan.Heur.AutoIT.1
Google	Detected
BitDefenderTheta	AI:Packer.DD8F3AD118
ALYac	Gen:Trojan.Heur.AutoIT.1
VBA32	Trojan.Autoit.F
Cylance	unsafe
Panda	Trj/Autoit.gen
TrendMicro-HouseCall	Mal_OtorunQ
Rising	Worm.Win32.AutoIt.bkw (CLASSIC)
Yandex	Worm.Autoit.Gen
Ikarus	Worm.Win32.Tifaut
Fortinet	W32/Autoit.XL!worm
AVG	Win32:Malware-gen
Cybereason	malicious.a0521b
DeepInstinct	MALICIOUS