Categories: Malware

What is “Exploit.Win32.BypassUAC.cqy”?

The Exploit.Win32.BypassUAC.cqy is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Exploit.Win32.BypassUAC.cqy virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Modifies host OEM information
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities for basic functionality
Attempts to modify desktop wallpaper
Uses suspicious command line tools or Windows utilities

How to determine Exploit.Win32.BypassUAC.cqy?


File Info:
name: AEB63E249590EC907D62.mlwpath: /opt/CAPEv2/storage/binaries/65e232c8a08569f77be731886192735bdd3b6e032800f60aed8a59f71e214ddacrc32: BB774E1Bmd5: aeb63e249590ec907d627e89cc33057bsha1: df854e72d4f8882343224f5be7b923afbc8a3756sha256: 65e232c8a08569f77be731886192735bdd3b6e032800f60aed8a59f71e214ddasha512: a92b543d101f3dec07c5a00fe267cf77eacbf1da0cfafc8a35b4ec787aa653db4d2d98982d093d68a67be80b44f383daa6fac7059b328f3991834d97cae3df9assdeep: 12288:e1JSgyPzsB7kmIFZUUvHqnuF2E8/LFE4Xqg28Eh/GYEYjUGDkkoTo:c0BG9gGUvH+u2LFE4h28E1jEYjUXRMtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17C255920A6928472DD41BDF0DE6EA676B569ADD50E1046F363B0FF3994322B3DC3621Csha3_384: c9c0b28c5277f7b763e8790bbf56c137aba15ededafcd05bbd59c697bd7840abcc53f7e7b2f148c4976d10f2e49be916ep_bytes: 558bec6aff68b0064400685c34430064timestamp: 2013-07-16 17:19:51
Version Info:
Comments: CompanyName: Chilkat Software, Inc.FileDescription: Self-ExtractorFileVersion: 1, 0, 0, 1InternalName: SelfEtractorLegalCopyright: Copyright © 2012LegalTrademarks: OriginalFilename: SelfExtractor.exePrivateBuild: ProductName: Chilkat Software, Inc. SaPayloadProductVersion: 1, 0, 0, 1SpecialBuild: Translation: 0x0409 0x04b0

Exploit.Win32.BypassUAC.cqy also known as:

Lionic	Hacktool.Win32.BypassUAC.3!c
DrWeb	Trojan.MulDrop8.25860
MicroWorld-eScan	Trojan.GenericKD.5705374
McAfee	Artemis!AEB63E249590
Cylance	Unsafe
Sangfor	Exploit.Win32.BypassUAC.cqy
Alibaba	Exploit:Win32/BypassUAC.8aa8cb8b
Cybereason	malicious.49590e
BitDefenderTheta	Gen:NN.ZexaF.34084.8q3@amlEePbi
Symantec	ML.Attribute.HighConfidence
TrendMicro-HouseCall	TROJ_GEN.R002C0WLA21
Avast	Win32:Malware-gen
Kaspersky	Exploit.Win32.BypassUAC.cqy
BitDefender	Trojan.GenericKD.5705374
NANO-Antivirus	Exploit.Win32.BypassUAC.erhgmv
Tencent	Win32.Exploit.Bypassuac.Lqyo
Ad-Aware	Trojan.GenericKD.5705374
Sophos	Generic PUA NP (PUA)
Comodo	Malware@#39pq0dxtfucw7
TrendMicro	TROJ_GEN.R002C0WLA21
McAfee-GW-Edition	BehavesLike.Win32.Generic.dm
FireEye	Generic.mg.aeb63e249590ec90
Emsisoft	Trojan.GenericKD.5705374 (B)
Paloalto	generic.ml
GData	Trojan.GenericKD.5705374
Arcabit	Trojan.Generic.D570E9E
Microsoft	Trojan:Win32/Wacatac.B!ml
AhnLab-V3	Trojan/Win32.BypassUAC.C2559469
VBA32	BScope.TrojanPSW.BAT.Agent
ALYac	Trojan.GenericKD.5705374
MAX	malware (ai score=100)
APEX	Malicious
Rising	Trojan.Generic@ML.82 (RDML:OwZtes8MnkWy8CtTZFE+MQ)
Yandex	Exploit.BypassUAC!KCEA3XybUWU
Ikarus	Exploit.BypassUAC
Fortinet	W32/BypassUAC.CQY!exploit
AVG	Win32:Malware-gen
Panda	Trj/CI.A