Adrozek.677 (file analysis)

The Adrozek.677 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Adrozek.677 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• At least one process apparently crashed during execution
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• A named pipe was used for inter-process communication
• Enumerates running processes
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• Created a process from a suspicious location
• Steals private information from local Internet browsers
• Collects and encrypts information about the computer likely to send to C2 server
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• Likely virus infection of existing system binary
• Creates a copy of itself

How to determine Adrozek.677?

File Info:
name: 2A99D15802CE6C91EDAF.mlw
path: /opt/CAPEv2/storage/binaries/79e1d2bc666a20b2a3e71c44d5bf57039ba7374774f2ff7cacad1c24efdc5544
crc32: 73C9A4A2
md5: 2a99d15802ce6c91edaf72410b0461f7
sha1: 8a6176a09382248047729ff1c5802921e279fb1a
sha256: 79e1d2bc666a20b2a3e71c44d5bf57039ba7374774f2ff7cacad1c24efdc5544
sha512: df001863d9670484f71b2bc6f5fb4bcc5c1afef3c22c09ce6710682ac014800d5cc3af905061087dd26b4fabb4493cbcc097819add1ee6de47bc3d739e7184af
ssdeep: 49152:f96YqGD9beVhfm2jumbx00eP2h4B/oJP1U1cyD:16dV4Kl0LBOy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T177B5E0531BA48298F6D66637C93B3F44723AEE521B0151E705D834DF2AB35C2BB31A93
sha3_384: 056f7e426f2c8f67b6e709626afec2b679fd7f3dd39a79c07087a95870ad8efa9c40f997de524dcf13adc7283c8cdd66
ep_bytes: 558bec6aff6860c8570068e0b4570064
timestamp: 2020-10-05 13:36:38

Version Info:
CompanyName: TalkHelper Inc.
FileDescription: TalkHelper Update
FileVersion: 1.3.5.0
InternalName: Update.exe
LegalCopyright: Copyright (C) 2015 TalkHelper Team, All Rights Reserved
OriginalFilename: Update.exe
ProductName: TalkHelper Video Recorder for Skype
ProductVersion: 1.3.5.0
Translation: 0x0409 0x0409

Adrozek.677 also known as:

How to remove Adrozek.677?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.