Categories: Malware

Dropped:Generic.BAT.Miner.A.1C75BEDC removal

The Dropped:Generic.BAT.Miner.A.1C75BEDC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Dropped:Generic.BAT.Miner.A.1C75BEDC virus can do?

  • Attempts to connect to a dead IP:Port (1 unique times)
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Steals private information from local Internet browsers
  • Installs itself for autorun at Windows startup
  • Attempts to access Bitcoin/ALTCoin wallets
  • Harvests credentials from local FTP client softwares
  • Attempts to interact with an Alternate Data Stream (ADS)
  • Created a service that was not started
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
cdn.discordapp.com
a.tomx.xyz
ocsp.digicert.com

How to determine Dropped:Generic.BAT.Miner.A.1C75BEDC?


File Info:

crc32: 992E34CBmd5: 5476b0f683a5ac1f4cf58df8b2410f24name: 5476B0F683A5AC1F4CF58DF8B2410F24.mlwsha1: d9c2c2843ad165713017f94f8b52f8d27c378359sha256: f1286dceccbcc4a2c195ecc407a1f634905f4a4972a8c72bd12e9f2d79473d5asha512: a7b740484b64e26be9ebde596ced881f6338b30613e88d285e61c6f86dd9652514a1e79bd370d534ba4493a1a3ca2d59944336398dde11a6e524b2c1f5ddfe1assdeep: 6144:65aWbksiNTBIbtCf2bZHCkjVnbh+trcY+Yt9o6YPD1+E+pE8zKAA:65atNTebAubZiwtnpT4/zKAAtype: PE32 executable (console) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Dropped:Generic.BAT.Miner.A.1C75BEDC also known as:

K7AntiVirus Trojan-Downloader ( 0058865e1 )
Elastic malicious (high confidence)
ALYac Dropped:Generic.BAT.Miner.A.1C75BEDC
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
BitDefender Dropped:Generic.BAT.Miner.A.1C75BEDC
K7GW Trojan-Downloader ( 0058865e1 )
Cybereason malicious.43ad16
Symantec ML.Attribute.HighConfidence
ESET-NOD32 BAT/TrojanDownloader.Agent.OIH
APEX Malicious
Cynet Malicious (score: 100)
MicroWorld-eScan Dropped:Generic.BAT.Miner.A.1C75BEDC
Ad-Aware Dropped:Generic.BAT.Miner.A.1C75BEDC
Sophos Generic ML PUA (PUA)
BitDefenderTheta Gen:NN.ZexaF.34236.wuX@a8ifwgf
FireEye Generic.mg.5476b0f683a5ac1f
Emsisoft Dropped:Generic.BAT.Miner.A.1C75BEDC (B)
SentinelOne Static AI – Malicious PE
Jiangmin Trojan.Inject.bzyo
eGambit PE.Heur.InvalidSig
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Arcabit Generic.BAT.Miner.A.1C75BEDC
GData Dropped:Generic.BAT.Miner.A.1C75BEDC
AhnLab-V3 Trojan/Win.Generic.R444362
Acronis suspicious
MAX malware (ai score=89)
Rising Trojan.Generic@ML.83 (RDMK:8iLXBpvfo8Pj/iy+0K2InA)
Ikarus Trojan-Downloader.BAT.Agent
MaxSecure Trojan.Malware.1991580.susgen

How to remove Dropped:Generic.BAT.Miner.A.1C75BEDC?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

BScope.Trojan.Meredrop removal instruction

The BScope.Trojan.Meredrop is considered dangerous by lots of security experts. When this infection is active,…

27 mins ago

Generic.Dacic.94CCEEA9.A.A35AF582 removal tips

The Generic.Dacic.94CCEEA9.A.A35AF582 is considered dangerous by lots of security experts. When this infection is active,…

46 mins ago

How to remove “Barys.431172 (B)”?

The Barys.431172 (B) is considered dangerous by lots of security experts. When this infection is…

55 mins ago

Win32/OfferCore.F potentially unwanted (file analysis)

The Win32/OfferCore.F potentially unwanted is considered dangerous by lots of security experts. When this infection…

56 mins ago

Worm.VobfusMF.S22387541 (file analysis)

The Worm.VobfusMF.S22387541 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Trojan.GenericRI.S31670896 malicious file

The Trojan.GenericRI.S31670896 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago