Categories: Malware

About “Generic.Dacic.1.BitCoinMiner.A.BB4BC020 (B)” infection

The Generic.Dacic.1.BitCoinMiner.A.BB4BC020 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Dacic.1.BitCoinMiner.A.BB4BC020 (B) virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Reads data out of its own binary image
Manipulates data from or to the Recycle Bin
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Installs itself for autorun at Windows startup
Attempts to disable UAC
Modifies Image File Execution Options, indicative of process injection or persistence

How to determine Generic.Dacic.1.BitCoinMiner.A.BB4BC020 (B)?


File Info:
name: AB8F8F4FF2918BC61559.mlwpath: /opt/CAPEv2/storage/binaries/77c44408a67833212e1c0f0c115a784e233d66a1c5a5e007ed947586a3f8da93crc32: B6799D1Fmd5: ab8f8f4ff2918bc6155925b54c608f3bsha1: 8428cf5abb4f369bc528b621b157330dbf5eca45sha256: 77c44408a67833212e1c0f0c115a784e233d66a1c5a5e007ed947586a3f8da93sha512: 8d7926292b54f74ef5465de1934f4f1609ccffa4a2bc303abffd6f1384f6c5a7ae24a5ad80bc82ecf2f6023fd0009476b15f27a0a30dee55634109d4e07f6276ssdeep: 196608:E2KKjQ+9RZ7YQoI+lffR2KKjQ+9RZ7YQoI+lffB:E2KKjBZ7YVhfR2KKjBZ7YVhfBtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T183B6B017A1D941E8C07AC1B8C6978A52FB71781B0334ABDF16E496652F23AF09F3E711sha3_384: f82115944a494b29792f5a44e9288cc03bf0b49cc6cba80e7c2e15e2dac90fe41ea377d9f8d6b451f103e069372ab3c6ep_bytes: 60be00c050008dbe0050efff5783cdfftimestamp: 2018-01-06 10:36:12
Version Info:
0: [No Data]

Generic.Dacic.1.BitCoinMiner.A.BB4BC020 (B) also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Generic.Dacic.1.BitCoinMiner.A.BB4BC020
FireEye	Generic.mg.ab8f8f4ff2918bc6
McAfee	GenericRXFJ-AZ!9331A72D00AA
Cylance	Unsafe
Zillya	Adware.DealPly.Win32.99941
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0013bf781 )
K7GW	Trojan ( 0013bf781 )
Cybereason	malicious.ff2918
BitDefenderTheta	Gen:NN.ZexaF.34114.@pJfaKXFdhlb
Cyren	W32/CoinMiner.L.gen!Eldorado
Symantec	Linux.Coinminer
ESET-NOD32	Win32/Agent.OCI
Cynet	Malicious (score: 100)
Kaspersky	not-a-virus:RiskTool.HTML.Miner.b
BitDefender	Generic.Dacic.1.BitCoinMiner.A.BB4BC020
NANO-Antivirus	Riskware.Win32.BitMiner.ewvndj
Avast	Win32:CryptoMiner-L [Trj]
Tencent	Risktool.Win32.Bitcoinminer.16000093
Ad-Aware	Generic.Dacic.1.BitCoinMiner.A.BB4BC020
Emsisoft	Generic.Dacic.1.BitCoinMiner.A.BB4BC020 (B)
Comodo	Application.Win32.BlackMoon.A@7iadub
DrWeb	Trojan.BtcMine.1759
McAfee-GW-Edition	BehavesLike.Win32.Generic.vh
Sophos	Troj/Agent-BCPA
APEX	Malicious
Jiangmin	Trojan.Generic.bwuwf
eGambit	Unsafe.AI_Score_100%
Avira	TR/Dropper.Gen9
Antiy-AVL	Trojan/Generic.ASBOL.B943
Microsoft	Trojan:Win32/Qhost
GData	Win32.Trojan.Agent.WP
SentinelOne	Static AI – Malicious PE
AhnLab-V3	Trojan/Win32.CoinMiner.R220228
Acronis	suspicious
VBA32	Trojan.BtcMine
ALYac	Generic.Dacic.1.BitCoinMiner.A.BB4BC020
MAX	malware (ai score=88)
Malwarebytes	Malware.AI.2683833645
Rising	Trojan.Kryptik!1.B3E8 (CLASSIC)
Yandex	Trojan.GenAsa!BereR0pX6lo
MaxSecure	Trojan.Risk.BitMiner.Gen
Fortinet	W32/CoinMiner.ESFJ!tr
AVG	Win32:CryptoMiner-L [Trj]