Categories: Virus

Crypto.Virus.FileInfector.DDS malicious file

The Crypto.Virus.FileInfector.DDS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Crypto.Virus.FileInfector.DDS virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Serbian (Cyrillic)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Behavioural detection: Transacted Hollowing
Creates a copy of itself
Deletes executed files from disk
Modifies Image File Execution Options, indicative of process injection or persistence
Created a service that was not started
Anomalous binary characteristics
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Crypto.Virus.FileInfector.DDS?


File Info:
name: D692854DBE1F2CE83568.mlwpath: /opt/CAPEv2/storage/binaries/8daf541f34510a8a0aa1a34538005e3573eb8f78e723092496daca0d532bf9dfcrc32: 1F9F17E0md5: d692854dbe1f2ce83568af45fbf0a444sha1: 7ca89d030867b3277a5b714fe1a58452ed943999sha256: 8daf541f34510a8a0aa1a34538005e3573eb8f78e723092496daca0d532bf9dfsha512: 0781a80fdfc417d018f8bdb2e66d561d7e65814c44f1b6893d36b2a3bb6576eb260fed4bd52291cb9d10dd131abed3f13d17a52a812b4ef6d4be51e0b6737eb3ssdeep: 24576:+fL4mfoRuP7ubEcoN+MzqQc9EPUwCD7nm/tVJLfkPhQD10vfHd3wwBjB:0zfoRuP5P8OswCwLJoPCDS3dwwVBtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1AA450202F2E34431E7B32933DAF4B2755979BD104B278A6F1384EA190E74E91AE25773sha3_384: d4141ae388a9b5ede3fe220c13f8dc98bc56db6a7933b8c18fdb2839fa57af24e16d4f37af7bb69744929f084bb41219ep_bytes: e86d020000e98efeffff558bec8b4508timestamp: 2019-02-21 11:44:31
Version Info:
CompanyName: CRYPTOCOMPANY OUFileDescription: CryptoTab Update SetupFileVersion: 1.3.99.23InternalName: CryptoTab Update SetupLegalCopyright: Copyright 2018 CRYPTOCOMPANY OUOriginalFilename: CryptoTabUpdateSetup.exeProductName: CryptoTab UpdateProductVersion: 1.3.99.23LanguageId: enPrivateBuild: Translation: 0x0409 0x04b0

Crypto.Virus.FileInfector.DDS also known as:

Bkav	W32.Common.0771A3BC
Lionic	Trojan.Win32.Cryptotab.4!c
MicroWorld-eScan	Trojan.GenericKD.46170372
FireEye	Trojan.GenericKD.46170372
ALYac	Trojan.GenericKD.46170372
Malwarebytes	Crypto.Virus.FileInfector.DDS
Zillya	Adware.CryptoTab.Win32.2
Sangfor	Trojan.Win32.Cryptotab.Va3e
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/CryptoTab.A potentially unwanted
BitDefender	Trojan.GenericKD.46170372
Emsisoft	Trojan.GenericKD.46170372 (B)
DrWeb	Trojan.MulDrop16.45014
VIPRE	Trojan.GenericKD.46170372
McAfee-GW-Edition	GenericRXHR-GW!D692854DBE1F
Sophos	Generic Reputation PUA (PUA)
GData	Trojan.GenericKD.46170372
Antiy-AVL	Trojan/Win32.SGeneric
Arcabit	Trojan.Generic.D2C08104
McAfee	GenericRXHR-GW!D692854DBE1F
MAX	malware (ai score=94)
Cylance	unsafe
Panda	Trj/CI.A
Rising	PUA.CryptoTab!8.12759 (CLOUD)
Yandex	Riskware.Agent!ZylfcmmGL0E
MaxSecure	Trojan.Malware.74350272.susgen
DeepInstinct	MALICIOUS