Trojan

BScope.Trojan.Crypt removal

Malware Removal

The BScope.Trojan.Crypt is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What BScope.Trojan.Crypt virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Injection with CreateRemoteThread in a remote process
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • A process attempted to delay the analysis task.
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Executed a process and injected code into it, probably while unpacking
  • Sniffs keystrokes
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Attempts to interact with an Alternate Data Stream (ADS)
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine BScope.Trojan.Crypt?


File Info:

crc32: 60C025C8
md5: 6c4bb3b95606b439e5e2fb3414c63b70
name: upload_file
sha1: 8b4e9c604c5597c660133da71e23cc1cd81bbe44
sha256: 738ea925d9f26dc03c18efd41de5e310285a36eef0147e7767a25dcf3fb1b24d
sha512: 8b91dc4328c62d56cd2ad023c483733c5375c41fdd68512ae18372e5862e0f3bfa4772036c4ccf70cf04969101ecd51f0c8590ff5149d2146479b3e257a4afdd
ssdeep: 12288:bV5mZ52HqKRoIYXSi8yrxEMPqdee+OLg8QeUhAgYD:B8ZqbfksrD6h6
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

BScope.Trojan.Crypt also known as:

BkavW32.AIDetectVM.malware2
Elasticmalicious (high confidence)
FireEyeGeneric.mg.6c4bb3b95606b439
McAfeeArtemis!6C4BB3B95606
Cybereasonmalicious.04c559
BitDefenderThetaGen:NN.ZelphiF.34152.PGW@ae5YHtfi
F-ProtW32/Injector.JHE
SymantecPacked.Generic.516
APEXMalicious
KasperskyUDS:DangerousObject.Multi.Generic
Paloaltogeneric.ml
RisingTrojan.Generic@ML.90 (RDML:wa5Xq4qYl4LvrAqShpoPZg)
Invinceaheuristic
IkarusWin32.Outbreak
ZoneAlarmUDS:DangerousObject.Multi.Generic
MicrosoftTrojan:Win32/Androm.VD!MTB
CynetMalicious (score: 100)
AhnLab-V3Suspicious/Win.Delphiless.X2091
VBA32BScope.Trojan.Crypt
SentinelOneDFI – Suspicious PE
FortinetW32/injector.EMXZ!tr
CrowdStrikewin/malicious_confidence_80% (D)
Qihoo-360HEUR/QVM05.1.2CB7.Malware.Gen

How to remove BScope.Trojan.Crypt?

BScope.Trojan.Crypt removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment