Categories: Malware

Babar.68572 removal

The Babar.68572 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Babar.68572 virus can do?

Sample contains Overlay data
Uses Windows utilities for basic functionality
HTTPS urls from behavior.
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to modify proxy settings
Touches a file containing cookies, possibly for information gathering
Uses suspicious command line tools or Windows utilities

How to determine Babar.68572?


File Info:
name: E3AFA45465569BC1C082.mlwpath: /opt/CAPEv2/storage/binaries/47fc63f93a577571555820525e8fc7134792fc5b8fc0c0969c09097c22217da1crc32: E4E3C5A3md5: e3afa45465569bc1c0829aacd3c4dcedsha1: 5fdb66a701c7836404c1d1157e3723e9d2de5537sha256: 47fc63f93a577571555820525e8fc7134792fc5b8fc0c0969c09097c22217da1sha512: a978ae043df75e16235dab0f68fa32d03bad24e3ce19a8baf1141ce03cca012c63e63ad6874249d3407d7982b7a5a9baf5a96bd472e018af12bb637f9af87237ssdeep: 768:e37zj55Nvfnokbb/RjUtS0xWboBK4mlHj5UUfoE8AnJd:6j55NHBv/1oc4mlHj5XoEJJdtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1C2437D7B79D084F6C545417105E4CBFB9B7F2F3101D115A3ABF0DC5A6F22BDAA22A20Asha3_384: d12cc0c41c712f478179e3b22e7e2f858cbed1adfd008e1fc48d19b07ff04bb5859bf026dcbb5c48fe7d271a086627d7ep_bytes: 558bec6aff680071400068103f400064timestamp: 2011-12-16 15:36:39
Version Info:
0: [No Data]

Babar.68572 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.lCuo
MicroWorld-eScan	Gen:Variant.Babar.68572
FireEye	Generic.mg.e3afa45465569bc1
Skyhigh	GenericRXVQ-ON!E3AFA4546556
ALYac	Gen:Variant.Babar.68572
Cylance	unsafe
Zillya	Dropper.Agent.Win32.577637
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 004023c61 )
Alibaba	Backdoor:Win32/Kanav.022fa4ad
K7GW	Trojan ( 004023c61 )
Cybereason	malicious.465569
Baidu	Win32.Trojan-Downloader.Agent.bl
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Alyak.E
APEX	Malicious
Kaspersky	Trojan-Dropper.Win32.Agent.gfbs
BitDefender	Gen:Variant.Babar.68572
NANO-Antivirus	Trojan.Win32.Agent.dayvyd
Avast	Win32:Inject-AQV [Trj]
Tencent	Trojan-Dropper.Win32.Agent.kb
Emsisoft	Gen:Variant.Babar.68572 (B)
F-Secure	Trojan.TR/Downloader.Gen
DrWeb	Trojan.Inject.59293
VIPRE	Gen:Variant.Babar.68572
Trapmine	suspicious.low.ml.score
Sophos	Troj/Kanav-A
SentinelOne	Static AI – Malicious PE
Jiangmin	TrojanDropper.Agent.bfzc
Google	Detected
Avira	TR/Downloader.Gen
Varist	W32/Heuristic-114!Eldorado
Antiy-AVL	Trojan[Backdoor]/Win32.Kanav.a
Kingsoft	malware.kb.a.1000
Microsoft	Backdoor:Win32/Kanav.A
Gridinsoft	Trojan.Win32.Downloader.sa
Xcitium	TrojWare.Win32.TrojanDownloader.Small.REK@4n2or7
Arcabit	Trojan.Babar.D10BDC
ZoneAlarm	Trojan-Dropper.Win32.Agent.gfbs
GData	Win32.Trojan.PSE.17HUNMA
Cynet	Malicious (score: 100)
AhnLab-V3	Dropper/Win32.OnlineGameHack.R18748
McAfee	GenericRXVQ-ON!E3AFA4546556
MAX	malware (ai score=87)
VBA32	BScope.Trojan.Jorik
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Genetic.gen
Rising	Backdoor.Kanav!1.9D4F (CLASSIC)
Yandex	Trojan.GenAsa!T94nMOBORCA
Ikarus	Trojan.Win32.Alyak
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.TODU!tr
BitDefenderTheta	AI:Packer.59E3A33F1E
AVG	Win32:Inject-AQV [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)
alibabacloud	Trojan[downloader]:Win/Agent.RAK