Categories: Malware

Dropped:Generic.PWStealer.4.9A7F218D removal tips

The Dropped:Generic.PWStealer.4.9A7F218D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Dropped:Generic.PWStealer.4.9A7F218D virus can do?

Sample contains Overlay data
Yara rule detections observed from a process memory dump/dropped files/CAPE
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Checks for the presence of known devices from debuggers and forensic tools
Checks for the presence of known devices from debuggers and forensic tools
Anomalous binary characteristics

How to determine Dropped:Generic.PWStealer.4.9A7F218D?


File Info:
name: 30B7660DE503242C88FD.mlwpath: /opt/CAPEv2/storage/binaries/ef291c195ff20229e9ff9c4cccf19d1af2bb47b8e86a7d04feb9451f00d4e76fcrc32: 1A606B32md5: 30b7660de503242c88fd0378e8679810sha1: 772764e3e362a8a4ad2d6ba64890b238d7d2f912sha256: ef291c195ff20229e9ff9c4cccf19d1af2bb47b8e86a7d04feb9451f00d4e76fsha512: 2b770562c3bb11c92cee8f49a544bfb409955382cd46831fde6b232c233b5c61d86b85d6d9ab4b7cff2205378a1fee644751713a36653571379684347bc9003essdeep: 1536:dZjXp0e2rBboJ6f30eZ9nyqqK/j8Wf0RsCxKoBn:/8lbq68g1dL8WfZCxKoBntype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10604AF9F3CC884B3CCC14272188A4773AA75F15411AB95527F88FD7B9D9F190AC3E2A6sha3_384: b22dd9a4a7de923131ccd03e5de3298fcf0fd4987e02f2d16591fbc211947557b67472e0c29fbacb19bd8b6167529c57ep_bytes: 558bec6aff6878a14000684065400064timestamp: 2002-12-10 12:18:45
Version Info:
0: [No Data]

Dropped:Generic.PWStealer.4.9A7F218D also known as:

Bkav	W32.AIDetect.malware1
DrWeb	Trojan.IframeExec
MicroWorld-eScan	Dropped:Generic.PWStealer.4.9A7F218D
FireEye	Generic.mg.30b7660de503242c
ALYac	Dropped:Generic.PWStealer.4.9A7F218D
Cylance	Unsafe
Zillya	Worm.Avron.Win32.6
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 004bcce41 )
K7GW	Trojan ( 004bcce41 )
Cybereason	malicious.de5032
BitDefenderTheta	AI:Packer.EACEC53222
Cyren	W32/Busky.B.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Lirva.F
APEX	Malicious
ClamAV	Win.Worm.Avron-9973725-0
Kaspersky	Email-Worm.Win32.Avron.f
BitDefender	Dropped:Generic.PWStealer.4.9A7F218D
NANO-Antivirus	Trojan.Win32.Avron.dqvwgr
Avast	Win32:Avron-F [Wrm]
Tencent	Email-Worm.Win32.Avron.ha
Ad-Aware	Dropped:Generic.PWStealer.4.9A7F218D
Emsisoft	Dropped:Generic.PWStealer.4.9A7F218D (B)
Comodo	Virus.Win32.Lirva.gen_MM0@1e3hp0
VIPRE	Dropped:Generic.PWStealer.4.9A7F218D
TrendMicro	WORM_LIRVA.GEN
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.cz
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A + W32/Avril-E
Ikarus	Email-Worm.Win32.Avron
GData	Dropped:Generic.PWStealer.4.9A7F218D
Jiangmin	Worm/Sramota.amd
Google	Detected
Avira	WORM/Rbot.Gen
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Generic.ASMalwS.D7F
Arcabit	Generic.PWStealer.4.9A7F218D
ZoneAlarm	Email-Worm.Win32.Avron.f
Microsoft	Worm:Win32/Naith.F@mm
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.C69140
Acronis	suspicious
McAfee	W32/Lirva.gen@MM
VBA32	Worm.Avron
Malwarebytes	Malware.AI.460234155
TrendMicro-HouseCall	WORM_LIRVA.GEN
Rising	Trojan.KillAV!1.66BF (CLASSIC)
Yandex	Trojan.GenAsa!fmPlwupPFeU
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Avron.F@mm
AVG	Win32:Avron-F [Wrm]
Panda	Trj/Genetic.gen