Categories: Malware

BScope.Malware-Cryptor.NSAnti.Gen.1 removal instruction

The BScope.Malware-Cryptor.NSAnti.Gen.1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What BScope.Malware-Cryptor.NSAnti.Gen.1 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Checks adapter addresses which can be used to detect virtual network interfaces
Guard pages use detected – possible anti-debugging.
A process attempted to delay the analysis task.
Dynamic (imported) function loading detected
Enumerates running processes
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to modify proxy settings
Attempts to modify browser security settings
Attempts to disable browser security warnings
Harvests cookies for information gathering
The sample wrote data to the system hosts file.

How to determine BScope.Malware-Cryptor.NSAnti.Gen.1?


File Info:
name: 8069D0E0128A5D8B192F.mlwpath: /opt/CAPEv2/storage/binaries/ba081f1bb2ab337ceca96ab862606e817c7a41f08fd12258eb14b536ddcfc507crc32: 2EA543E4md5: 8069d0e0128a5d8b192fa71ef11d0b84sha1: dde14e4e121e716be6eb897711dfce3ae1f88df0sha256: ba081f1bb2ab337ceca96ab862606e817c7a41f08fd12258eb14b536ddcfc507sha512: 31026f44dd5a17e661b65b21d7d4d2b98dd3be17c54ddbf2eb770887481a70b1ed0c4f1719bff11fd147680ded348ba0a781e2cd538db9d20123f6264a5987bbssdeep: 24576:YtnL761CcFLAq9hUqXWszFRIGBR60rzrJ:Ytnn61rAqXFX9LIGB/Pttype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17D458D1576A0C1B2C2E86D306DA6FB702EBE6C705D395A8736C83B6D3E710C15A29D1Fsha3_384: 912445ded1901e08fba4acf47cd2daa4ad13848f0950e9329912a13aca4ae34c694f9d7fa01b0603b9b0ddd5616f753eep_bytes: e83db30000e978feffffcccccccccccctimestamp: 1970-01-01 01:40:48
Version Info:
Comments: IE_FREAMEFileDescription: pulicFileVersion: 1, 5, 11, 1315ProductName: IE_FREAMEProductVersion: 0, 0, 0, 1Translation: 0x0804 0x03a8

BScope.Malware-Cryptor.NSAnti.Gen.1 also known as:

Bkav	W32.AIDetect.malware2
tehtris	Generic.Malware
DrWeb	Trojan.DownLoader17.62402
MicroWorld-eScan	Gen:Variant.Adware.Midie.66109
FireEye	Generic.mg.8069d0e0128a5d8b
CAT-QuickHeal	Trojan.Skeeyah.S18729
McAfee	GenericR-FFY!8069D0E0128A
Cylance	Unsafe
VIPRE	Gen:Variant.Adware.Midie.66109
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Adware ( 004b8f741 )
K7GW	Adware ( 004b8f741 )
Cybereason	malicious.e121e7
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Adware.Zzinfor.A
ClamAV	Win.Malware.Zzinfor-9753457-0
Kaspersky	VHO:Trojan-Dropper.Win32.Injector.gen
BitDefender	Gen:Variant.Adware.Midie.66109
NANO-Antivirus	Trojan.Win32.Dwn.dyyhjb
Avast	Win32:TrojanX-gen [Trj]
Rising	Trojan.Clicker!1.ADC5 (CLASSIC)
Ad-Aware	Gen:Variant.Adware.Midie.66109
Emsisoft	Gen:Variant.Adware.Midie.66109 (B)
Comodo	TrojWare.Win32.Zzinfor.B@7x6n2g
Baidu	Win32.Trojan-Clicker.Agent.b
Zillya	Trojan.ZzinforGen.Win32.3
McAfee-GW-Edition	GenericR-FFY!8069D0E0128A
Trapmine	malicious.high.ml.score
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan.Win32.Spy
GData	Win32.Trojan.PSE.13EBSAN
Jiangmin	Trojan/Generic.bgssc
Avira	TR/Downloader.Gen7
MAX	malware (ai score=63)
Antiy-AVL	Trojan/Generic.ASMalwS.3303
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
Cynet	Malicious (score: 100)
VBA32	BScope.Malware-Cryptor.NSAnti.Gen.1
ALYac	Gen:Variant.Adware.Midie.66109
Malwarebytes	Adware.Zzinfor
APEX	Malicious
Tencent	Malware.Win32.Gencirc.10b84f03
Yandex	Trojan.GenAsa!+2fev3cfj3U
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	Adware/Zzinfor.A
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_70% (D)