Dropped:Generic.BAT.Miner.A.729CACAA (file analysis)

The Dropped:Generic.BAT.Miner.A.729CACAA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Dropped:Generic.BAT.Miner.A.729CACAA virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Created a process from a suspicious location
• The executable used a known stolen/malicious Authenticode signature
• Attempts to interact with an Alternate Data Stream (ADS)

How to determine Dropped:Generic.BAT.Miner.A.729CACAA?

File Info:
name: E67BC21FE2B84BC8185A.mlw
path: /opt/CAPEv2/storage/binaries/07e425bc7126c7928929d149b1f4a93853d98a2c90ee41c41b19f0a1c24274d3
crc32: FF016734
md5: e67bc21fe2b84bc8185a1c0f09e95664
sha1: 3d14ee9ba7d111835b5220d3378f1be33cca7ed1
sha256: 07e425bc7126c7928929d149b1f4a93853d98a2c90ee41c41b19f0a1c24274d3
sha512: 68ca5ebde11dbb0c6932a68d10076593bb76b8c884f1f7e0cadc7f85b2dd7341850165ff9299bc5aab185a81277bc1c4a6df0c7c17ccd0d63847f04e86d71bbe
ssdeep: 6144:q5aWbksiNTBmADzKdk/kDbZY63Zy6EPy585zurNtJ4P7RrQ:q5atNTMADIkYbTAoxBtJ4Pd0
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T11E740145B3F255F3E5E245320194A96FAB39B335972099EBC39C2D025503AC26ABD3EC
sha3_384: 56eee3135c5d6a4577ce6a5e2e2919f7bc1b9bc62206ef0658d201d1e50c008d2720b3f1ce7272923026f92c6b31b399
ep_bytes: 68ac00000068000000006868804100e8
timestamp: 2018-02-01 20:18:05

Version Info:
0: [No Data]

Dropped:Generic.BAT.Miner.A.729CACAA also known as:

How to remove Dropped:Generic.BAT.Miner.A.729CACAA?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.