Malware

Should I remove “DropperX-gen [Drp]”?

Malware Removal

The DropperX-gen [Drp] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What DropperX-gen [Drp] virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • A process created a hidden window
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • Behavioural detection: Injection (Process Hollowing)
  • Executed a process and injected code into it, probably while unpacking
  • Behavioural detection: Injection (inter-process)
  • Created a process from a suspicious location

How to determine DropperX-gen [Drp]?


File Info:

name: 2F7C9250B477B76B5CDF.mlw
path: /opt/CAPEv2/storage/binaries/ce5062c795a4d447b3fa81ddd405677ea013bc20b1526ae133e1e6c6696766b5
crc32: 029E405F
md5: 2f7c9250b477b76b5cdf57a0c440e160
sha1: 5a9574c6835663db844910bfd9b4291b8927a840
sha256: ce5062c795a4d447b3fa81ddd405677ea013bc20b1526ae133e1e6c6696766b5
sha512: 9494dc9c9007fcc553906f087d2cee59f95b2e1699496526095febba0f12ef2d3982bcb74b6b0cf5e17f5af140ded3464204bd3e8c474ad01cb90170109a7f2c
ssdeep: 1536:A/EVG3ChQ2nkoFesYPr4cbr5M5JJ6FTCCqlbkaiXlPRtPcq4fMiHWnKl:A/Z3wQ22s9cb8X6w7bCXlfclfknU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18704AF1076F0C033D1B25A7019B0D6919AEEBD526BB448CF379816BE6F312C29BB9357
sha3_384: ce67594be158bd639d1ac5b4892fdb6ba46dfac0c26297dde9bc912ccb2c5132c6cf9ff03727df09f3c5839670c0bf1e
ep_bytes: e8401a0000e989feffff578bc683e00f
timestamp: 2021-05-28 04:47:02

Version Info:

FileVersion: 8.71.86.86
Copyrighz: Copyright (C) 2022, pazkarte
ProjectVersion: 28.81.74.73

DropperX-gen [Drp] also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Babar.40430
FireEyeGeneric.mg.2f7c9250b477b76b
ALYacGen:Variant.Babar.40430
CylanceUnsafe
Cybereasonmalicious.683566
CyrenW32/Kryptik.GKN.gen!Eldorado
SymantecPacked.Generic.525
APEXMalicious
KasperskyVHO:Trojan.Win32.Agent.gen
BitDefenderGen:Variant.Babar.40430
AvastDropperX-gen [Drp]
Ad-AwareGen:Variant.Babar.40430
SophosML/PE-A
McAfee-GW-EditionBehavesLike.Win32.Emotet.ct
EmsisoftGen:Variant.Babar.40430 (B)
GDataGen:Variant.Babar.40430
MAXmalware (ai score=88)
ArcabitTrojan.Babar.D9DEE
ZoneAlarmVHO:Trojan.Win32.Agent.gen
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
CynetMalicious (score: 100)
Acronissuspicious
MalwarebytesTrojan.MalPack.GS
RisingTrojan.Generic@AI.95 (RDMK:cmRtazo2w2qMxB1FRIVXFrgoy+N0)
SentinelOneStatic AI – Suspicious PE
MaxSecureTrojan.Malware.300983.susgen
AVGDropperX-gen [Drp]
CrowdStrikewin/malicious_confidence_100% (W)

How to remove DropperX-gen [Drp]?

DropperX-gen [Drp] removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment