Trojan

BScope.Trojan-Dropper.Injector removal

Malware Removal

The BScope.Trojan-Dropper.Injector is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What BScope.Trojan-Dropper.Injector virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Mimics the system’s user agent string for its own requests
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Deletes its original binary from disk
  • Attempts to remove evidence of file being downloaded from the Internet
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Anomalous binary characteristics

How to determine BScope.Trojan-Dropper.Injector?


File Info:

crc32: AD30BFFF
md5: 9a2fba9e58078cd8e89e1d240f66bf47
name: h0qpggxeg.exe
sha1: bfcdc38ddcd573ca89ba6e4a88a70bc593a68a42
sha256: b644a459971c7845fd3ffc857a7cafc8e5404f43ba87d03ce93bb3c26793d11f
sha512: c1859fbf5c9a66d60a5fb013cb27812722ba2ab6c55667a8384b59d5e8e71dc9fe46e5c12f7e2a2d730414e9433bbdc796ceb8086cc8e1b740b3217f14f3929f
ssdeep: 3072:YqHuHOn5SmyOMHudWmChnh7oMFHo/BcMir6epWu54tItpR:YqOK5SmyOH8F4cyepWy
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2002
InternalName: TransparentDialog
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: TransparentDialog Application
ProductVersion: 1, 0, 0, 1
FileDescription: TransparentDialog MFC Application
OriginalFilename: TransparentDialog.EXE
Translation: 0x0409 0x04b0

BScope.Trojan-Dropper.Injector also known as:

Cybereasonmalicious.ddcd57
BitDefenderThetaGen:NN.ZexaF.33556.ny1@aSWS8Nei
APEXMalicious
RisingTrojan.Generic@ML.81 (RDML:590CASt26GbHcqwxO6ZG1g)
Invinceaheuristic
Trapminemalicious.high.ml.score
WebrootW32.Trojan.Emotet
Endgamemalicious (high confidence)
MicrosoftTrojan:Win32/Wacatac.B!ml
Acronissuspicious
VBA32BScope.Trojan-Dropper.Injector
SentinelOneDFI – Suspicious PE
Qihoo-360HEUR/QVM07.1.FB7D.Malware.Gen

How to remove BScope.Trojan-Dropper.Injector?

BScope.Trojan-Dropper.Injector removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment