Categories: Malware

How to remove “Dropped:Generic.Zegost.3.CF2928F5”?

The Dropped:Generic.Zegost.3.CF2928F5 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Dropped:Generic.Zegost.3.CF2928F5 virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Enumerates running processes
Expresses interest in specific running processes
Reads data out of its own binary image
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Installs itself for autorun at Windows startup
Installs itself for autorun at Windows startup

How to determine Dropped:Generic.Zegost.3.CF2928F5?


File Info:
name: D184AF0E1FC2A1C463C0.mlwpath: /opt/CAPEv2/storage/binaries/c52daff2a47242c82015519a944351c0b05747352ac91a53fb8383c1fccbdbeccrc32: EAFF4FF7md5: d184af0e1fc2a1c463c07d37b28e8f39sha1: 1b2d2946b2e09c67d52f5262f8b5c4360e2ad4casha256: c52daff2a47242c82015519a944351c0b05747352ac91a53fb8383c1fccbdbecsha512: 4327cc9f0c53e6d2bcee22b852719a6ab6a71863d2bc09c42715b964c25113b12557932fbcd9e6c97c2ce8c76c89313e9424255bc378dc03d75efe46799514d5ssdeep: 768:yPp7TqNCLNPRirOAGY0QBUuF6/RUZJBcfVAzSxXGB/dgeCfi3s:yB7TtLVgCHvtCkGBW5q3stype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10A635A46EA888477F5B354F4546A27B30E629D7843160BEF7BC0FD1929B22F4393621Bsha3_384: 7de6f273e5b3b85db62ff44f6e35754829f18e90ebf7716e3ac395c89037aa5aa9dd974fef808d6bce98513ceda6d589ep_bytes: 558bec6aff68003340006820bc400064timestamp: 2021-11-28 19:24:04
Version Info:
CompanyName: 360.cnFileDescription: 360杀毒 升级提示FileVersion: 5, 0, 0, 5071InternalName: UpTip.exeLegalCopyright: (C)360.cn Inc.All Rights Reserved.OriginalFilename: UpTip.exeProductName: 360杀毒ProductVersion: 5, 0, 0, 5071Translation: 0x0804 0x04b0

Dropped:Generic.Zegost.3.CF2928F5 also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Dropped:Generic.Zegost.3.CF2928F5
FireEye	Generic.mg.d184af0e1fc2a1c4
CAT-QuickHeal	Backdoor.Zegost.19753
ALYac	Dropped:Generic.Zegost.3.CF2928F5
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	AI:Packer.89A5B5131F
Cyren	W32/Farfli.BG.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Fusing.CF
Baidu	Win32.Trojan.Agent.abl
TrendMicro-HouseCall	BKDR_ZEGOST.SM44
Paloalto	generic.ml
ClamAV	Win.Malware.Zegost-9819547-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Dropped:Generic.Zegost.3.CF2928F5
Avast	Win32:Dropper-ODE [Drp]
Ad-Aware	Dropped:Generic.Zegost.3.CF2928F5
Emsisoft	Dropped:Generic.Zegost.3.CF2928F5 (B)
Comodo	TrojWare.Win32.Kryptik.ATA@4na219
TrendMicro	BKDR_ZEGOST.SM44
McAfee-GW-Edition	BehavesLike.Win32.CoinMiner.km
SentinelOne	Static AI – Suspicious PE
Sophos	ML/PE-A
APEX	Malicious
GData	Dropped:Generic.Zegost.3.CF2928F5
Avira	TR/Redosdru.WP
Arcabit	Generic.Zegost.3.CF2928F5
Microsoft	Backdoor:Win32/Zegost.DA
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Farfli.R118528
Acronis	suspicious
McAfee	GenericRXIY-GU!D184AF0E1FC2
MAX	malware (ai score=86)
VBA32	BScope.Trojan.MulDrop
Malwarebytes	Backdoor.Farfli
Rising	Backdoor.Fusing!1.BCB6 (CLASSIC)
Yandex	Trojan.GenAsa!CvfIpwXHk1g
Ikarus	Trojan.Win32.Redosdru
Fortinet	W32/Agent.QRZ!tr
AVG	Win32:Dropper-ODE [Drp]
Cybereason	malicious.e1fc2a
Panda	Generic Suspicious