Dropped:Generic.AutorunINF.Recex.1.1C7C33CC (B) (file analysis)

The Dropped:Generic.AutorunINF.Recex.1.1C7C33CC (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Dropped:Generic.AutorunINF.Recex.1.1C7C33CC (B) virus can do?

• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• Creates an autorun.inf file
• Authenticode signature is invalid
• Checks for the presence of known devices from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Binary file triggered YARA rule
• Creates a copy of itself
• Attempts to disable or modify Explorer Folder Options
• Attempts to disable UAC
• Touches a file containing cookies, possibly for information gathering
• The sample wrote data to the system hosts file.
• Attempts to block SafeBoot use by removing registry keys
• Yara detections observed in process dumps, payloads or dropped files

How to determine Dropped:Generic.AutorunINF.Recex.1.1C7C33CC (B)?

File Info:
name: 599EA4C9DB05B7453557.mlw
path: /opt/CAPEv2/storage/binaries/c93eca5a4a96a6051885d05c6723aa2297b5a6e833fda93b32659533a15eb509
crc32: DD5184C5
md5: 599ea4c9db05b74535576cac99daa91c
sha1: 10b51f38d1f0c360385ef3f40058b4e9b6f24997
sha256: c93eca5a4a96a6051885d05c6723aa2297b5a6e833fda93b32659533a15eb509
sha512: cc3effcbb146397e273edd2edf2db0d9ca5e4513111764eca8edf47de1777ec63d0329ddd335a16c45c393b741c3c3d1a10abe2334e242a5e6e035613af23d45
ssdeep: 12288:7bu+yES/1Z3jccvQVCrulyft43ZDKPlLfc8auwwstCqTl:7bBy31Z3jc1VCrulw6ZDKPlrc8a/w0Tl
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E3E4AE03B2D084B2EAA747701CB1D7358A77FD656EB0825F6358EB5D2FB2790891630B
sha3_384: d491745da0467b81d8e0531d896b6020c5a0efe60bbdf32746763dd952ca798b3036dbb950c3f7bf7097775ae58c3671
ep_bytes: 558bec6aff6800d34100683caa400064
timestamp: 2018-01-10 12:57:18

Version Info:
FileVersion: 3, 2, 2, 2075
ProductVersion: 3, 2, 2, 2075
CompanyName: 360.cn
FileDescription: 360主动防御服务模块
InternalName: ZhuDongFangYu
LegalCopyright: (C)360.cn All Rights Reserved.
OriginalFilename: ZhuDongFangYu.exe
ProductName: 360安全卫士
Translation: 0x0804 0x04b0

Dropped:Generic.AutorunINF.Recex.1.1C7C33CC (B) also known as:

How to remove Dropped:Generic.AutorunINF.Recex.1.1C7C33CC (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.