Categories: Malware

Dropped:Generic.Bat.Bomb.A.8C45C999 (file analysis)

The Dropped:Generic.Bat.Bomb.A.8C45C999 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Dropped:Generic.Bat.Bomb.A.8C45C999 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
Creates an indicator observed in Territorial Disputes report SIG40
Dynamic (imported) function loading detected
A process created a hidden window
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities for basic functionality
Created a process from a suspicious location
Detects Bochs through the presence of a registry key
Accessed credential storage registry keys
Harvests information related to installed mail clients

How to determine Dropped:Generic.Bat.Bomb.A.8C45C999?


File Info:
name: B2CE441E387FA3A8AC7D.mlwpath: /opt/CAPEv2/storage/binaries/0a279114f2fdb7b9170c1aa5f4b7a4352e6f7b33d4665cc9127d2b4a54f8b57fcrc32: 2A4FAD26md5: b2ce441e387fa3a8ac7d9db4004159b9sha1: 7fd6d1473a64a5d60477419018365167bfd9aa84sha256: 0a279114f2fdb7b9170c1aa5f4b7a4352e6f7b33d4665cc9127d2b4a54f8b57fsha512: 06c45f972a33632e746de13d76c27bbd371ea0e92d4e194cb44c671391af555dd16e84d8c7539d399c9c2661a7ee24b99a48929d95a81e0099de28c0a1d041c7ssdeep: 1536:X7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfnxq:Lq6+ouCpk2mpcWJ0r+QNTBfnAtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B6936C45F3E241F7EAF10A7100A6712FE73666249724E8DBC34C3D829553AD19A3C3E9sha3_384: 8108213c5e15dee7e9bc453bc0b4ea6743443b3e9625b3dd916bc8656dc41082eb147fc9225092061c48ac0372dd2ac4ep_bytes: 68ac00000068000000006810804100e8timestamp: 2019-07-30 08:52:50
Version Info:
0: [No Data]

Dropped:Generic.Bat.Bomb.A.8C45C999 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Tiny.trFe
Elastic	malicious (high confidence)
MicroWorld-eScan	Dropped:Generic.Bat.Bomb.A.8C45C999
FireEye	Generic.mg.b2ce441e387fa3a8
CAT-QuickHeal	Trojan.GenericPMF.S17672681
ALYac	Dropped:Generic.Bat.Bomb.A.8C45C999
Cylance	Unsafe
Zillya	Tool.Lazagne.Win32.102
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.73a64a
VirIT	Trojan.Win32.Genus.IHW
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.SchoolBoy.nck
BitDefender	Dropped:Generic.Bat.Bomb.A.8C45C999
Avast	FileRepMalware
Ad-Aware	Dropped:Generic.Bat.Bomb.A.8C45C999
Sophos	Generic ML PUA (PUA)
TrendMicro	TROJ_GEN.R002C0PAK22
McAfee-GW-Edition	BehavesLike.Win32.Generic.mh
Emsisoft	Dropped:Generic.Bat.Bomb.A.8C45C999 (B)
GData	Win32.Trojan.PSE.DR6CWW
Antiy-AVL	Trojan/Generic.ASMalwS.2B9EB3B
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
McAfee	RDN/Generic.grp
MAX	malware (ai score=80)
Malwarebytes	Malware.AI.392946571
TrendMicro-HouseCall	TROJ_GEN.R002C0PAK22
Rising	Trojan.SchoolBoy!8.B629 (CLOUD)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/PossibleThreat
AVG	FileRepMalware
Panda	Trj/CI.A