About “Dropped:Trojan.Downloader.JQJR” infection

The Dropped:Trojan.Downloader.JQJR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Dropped:Trojan.Downloader.JQJR virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Manipulates data from or to the Recycle Bin
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Attempts to modify proxy settings
• Attempts to modify browser security settings

Related domains:

How to determine Dropped:Trojan.Downloader.JQJR?

File Info:
name: EC5270C70B35E6E02A59.mlw
path: /opt/CAPEv2/storage/binaries/4b876fdaaa88183669c52d1987edefbbd1bb6b640a3fda8a825924b4240c0970
crc32: A9E2F1F5
md5: ec5270c70b35e6e02a593cdb6405fe88
sha1: 2a2cb147d23c998f9304e9913cd41d6321c6bc79
sha256: 4b876fdaaa88183669c52d1987edefbbd1bb6b640a3fda8a825924b4240c0970
sha512: 75e0a81c526ecd5cc8d5237a78a445d56838daaed71bed1bbd4fbd93d7e9453646fefc9bc139377b9ad7e04d7edbc082d3f7ce9eceb33bc395f8c824ae65120a
ssdeep: 12288:r14Yavl7hopQHi/5OLYxdFWebuK7koG3K/VblQcBMNy6TK:h4Y2FOp/5OLYxdgebl9CcBMIp
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T16EB412428A10D056FBA847721603F9D1091BAC7D04E6F26EF579BD3C3E715D34AA38AE
sha3_384: f64fc4fdc5309c3a931e87a2c39690111b89e96de413a6bea1c1a4bba8efd3bf73a82fa1179822a02f58cba2a9dc8124
ep_bytes: 60be00204e008dbe00f0f1ff5783cdff
timestamp: 2021-09-14 15:06:35

Version Info:
CompanyName: 溜云库
FileDescription: 文件更新工具
FileVersion: 1.0.0.26
InternalName: 文件更新工具
LegalCopyright: Copyright (C) Maple 2021
OriginalFilename: CopyFiles.exe
ProductName: 文件更新工具
ProductVersion: 1.0.0.26
Translation: 0x0009 0x04b0

Dropped:Trojan.Downloader.JQJR also known as:

How to remove Dropped:Trojan.Downloader.JQJR?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.