Generic.Keylogger.2.ACD53EE1 (file analysis)

The Generic.Keylogger.2.ACD53EE1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Keylogger.2.ACD53EE1 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Generic.Keylogger.2.ACD53EE1?

File Info:
name: CA768E05515EE9CEEA7C.mlw
path: /opt/CAPEv2/storage/binaries/f185df1fdfe2a01aecbd10a990ccc9073e76cd8b457e4a17dbf01164e117cc61
crc32: 63B699FB
md5: ca768e05515ee9ceea7c6da4809bed29
sha1: c61b8b8177c91db2c378c79e2a7f51ed0abd0e4a
sha256: f185df1fdfe2a01aecbd10a990ccc9073e76cd8b457e4a17dbf01164e117cc61
sha512: 6b3b41b7abc7b6a0146cec431b0ddbbf295d9253425d82b6384b23e6802611118f995e48f681b804cec1d9040848f94decd7a776d1944b395efa375e7421688f
ssdeep: 49152:wx3eRdmSC7N3DjjJEzAimq+/9YnFlugiTu:B7mSCJzjdEEeLlug
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A285334C3370BEBACA1B827A72411911F027FA6BD850C99D481EBF319DB87D4EB5452B
sha3_384: 7542641560afa58556bdb7a63c610a98fee4409175806c148c8c2e60591a6b9ca9791574a421ecefeff3c0696c90d044
ep_bytes: 60be151077008dbeebffc8ffc787c828
timestamp: 2022-06-20 15:41:42

Version Info:
CompanyName: © Microsoft Corporation
FileDescription: Host Process for Windows Services
FileVersion: 6.2.19041.546 
LegalCopyright: © Microsoft Corporation. All rights reserved
OriginalFilename: svhost.exe
PrivateBuild: 10.0.19041.546
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.19041.546
Translation: 0x0409 0x04b0

Generic.Keylogger.2.ACD53EE1 also known as:

How to remove Generic.Keylogger.2.ACD53EE1?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.