Generic.Keylogger.2.0F52CED7 (file analysis)

The Generic.Keylogger.2.0F52CED7 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Keylogger.2.0F52CED7 virus can do?

Executable code extraction
At least one process apparently crashed during execution
Creates RWX memory
A process attempted to delay the analysis task.
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Deletes its original binary from disk
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Checks the CPU name from registry, possibly for anti-virtualization
Checks the system manufacturer, likely for anti-virtualization
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Generic.Keylogger.2.0F52CED7?


File Info:
crc32: 967DEE30
md5: 7ba40b61334a7b9f5bc3f307cadbbfa9
name: 5.exe
sha1: 5f3f89c2162e13378fb90a1e589156a926c15609
sha256: 8c0a04f7263bfa6120aee3ef270a4fdd11fd6be50de7ac06c0dd3b2b67e2ea50
sha512: 5ddb289d986b6892cf0f8119fd85cb35a40c7f15cb0d5e2ae2e1aec3a78b4018b932999c61963bf9f957213936005ff749839362057c60a33d390480b7d1dbcc
ssdeep: 12288:s78gnV/2okya+bFOfv8t5NY12GFH/xmUhhgfW0HmQcdnMOyjlo0fWiAqe:s7xOokesf05W12E/MUhkW2cdMOIJAqe
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Proteug (C) x4fddx7559x6240x6709x6743x5229x3002
InternalName: Server.exe
FileVersion: 7, 10, 33, 380
CompanyName: Labeter 2005-2017
ProductName: TODO: 
ProductVersion: 7, 10, 33, 380
FileDescription: Proteug 10 AppLication
OriginalFilename: Server.exe
Translation: 0x0804 0x03a8

Generic.Keylogger.2.0F52CED7 also known as:

MicroWorld-eScan	DeepScan:Generic.Keylogger.2.0F52CED7
McAfee	GenericRXFS-XL!7BA40B61334A
Cylance	Unsafe
Sangfor	Malware
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	DeepScan:Generic.Keylogger.2.0F52CED7
APEX	Malicious
ClamAV	Win.Malware.Deepscan-6972384-0
GData	DeepScan:Generic.Keylogger.2.0F52CED7
Rising	Malware.Heuristic!ET#80% (RDMK:cmRtazrscwPakEN48Jlaf4Ht08fw)
Endgame	malicious (high confidence)
Emsisoft	DeepScan:Generic.Keylogger.2.0F52CED7 (B)
Comodo	TrojWare.Win32.Kryptik.ATA@4na219
Invincea	heuristic
McAfee-GW-Edition	GenericRXFS-XL!7BA40B61334A
FireEye	Generic.mg.7ba40b61334a7b9f
Ikarus	Trojan-Downloader.Win32.Agent
Webroot	W32.Trojan.Gen
MAX	malware (ai score=84)
Arcabit	DeepScan:Generic.Keylogger.2.0F52CED7
Microsoft	Backdoor:Win32/PcClient.ZR
Acronis	suspicious
VBA32	BScope.Trojan-GameThief.Magania
ALYac	DeepScan:Generic.Keylogger.2.0F52CED7
Ad-Aware	DeepScan:Generic.Keylogger.2.0F52CED7
Malwarebytes	Trojan.Injector
SentinelOne	DFI – Suspicious PE
Fortinet	W32/Generic.AP.1B7A06!tr
BitDefenderTheta	Gen:NN.ZexaF.34110.6u1@aSoucylb

How to remove Generic.Keylogger.2.0F52CED7?

Generic.Keylogger.2.0F52CED7 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Generic.Keylogger.2.0F52CED7 (file analysis)