About “BScope.TrojanDownloader.Refroso” infection

The BScope.TrojanDownloader.Refroso is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What BScope.TrojanDownloader.Refroso virus can do?

• A file was accessed within the Public folder.
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Attempted to write directly to a physical drive
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine BScope.TrojanDownloader.Refroso?

File Info:
name: 16CA3EB4821805396DF6.mlw
path: /opt/CAPEv2/storage/binaries/340b93ad732a8dfa695d3db15a15564942b925ac583007c5807a422670787150
crc32: D84E5C5F
md5: 16ca3eb4821805396df66ce06b1e89ba
sha1: 6503cc5fc9e0a4db1b90abdf99e0218f288ce8df
sha256: 340b93ad732a8dfa695d3db15a15564942b925ac583007c5807a422670787150
sha512: 3e1a63b62e52007cec6476b218bcddcde4865f53d7701cc5ee844c8cf021f7135bc3534828db8932f89ef85fccf7529d621b29b81dfd5a7808c2e733eeec55e4
ssdeep: 24576:7Mv+a7PI9q7g04IbSOJqAQrINwVn7dOEdV/RxN5hMnPUs:7XazI9CSdR3l/N4P
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EE65BF32F2914837C5731A3C8D6B9798992ABE103E78A88B3BF51D4C4F397817C65297
sha3_384: dddc17f72fe6f8f345eaaf24892bdca59da53b110b11add6cbbe82fb89fb225947ebb867a403f01def759fb89b055c88
ep_bytes: 558bec83c4f0b878804d00e88cecf2ff
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

BScope.TrojanDownloader.Refroso also known as:

How to remove BScope.TrojanDownloader.Refroso?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.