What is “Generic.MSIL.Bladabindi.DFA6E9DD”?

The Generic.MSIL.Bladabindi.DFA6E9DD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.MSIL.Bladabindi.DFA6E9DD virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Checks adapter addresses which can be used to detect virtual network interfaces
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Anomalous .NET characteristics
• Uses Windows utilities for basic functionality
• Sniffs keystrokes
• Installs itself for autorun at Windows startup
• CAPE detected the njRat malware family
• Creates a copy of itself
• Creates known Njrat/Bladabindi RAT registry keys

How to determine Generic.MSIL.Bladabindi.DFA6E9DD?

File Info:
name: 3CB1F109DD9B1A294281.mlw
path: /opt/CAPEv2/storage/binaries/979d309476cd05ddd9ce377e7d353038f15838f4b08912b36f1210f503bd58c6
crc32: 54B46A3D
md5: 3cb1f109dd9b1a2942815233614f5c6d
sha1: 99d0ea1c61f1d8d607c192d8e445be97795c06a6
sha256: 979d309476cd05ddd9ce377e7d353038f15838f4b08912b36f1210f503bd58c6
sha512: fc4d660e885e0a40f5aab9c20de9143519e04c3bf460e63b8b133dae9c68ac04385085c71a231aba58c4b0e0629e61425f9cf26456da5b05c756500a900f2a4d
ssdeep: 6144:b3WV17xwTguK5X1KyklAUUZ3LOs5CSMQAx4D1E9WN:rWVxxNljuivLOs5xMq1
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14A54BF293BECD403C6C983FCE4A745A447F6DE00B493E7AE901D3AB66A572D50E1924F
sha3_384: b68c9d5d92f22c1a8ccd6afd62cf5d8b54398e4d11b6f91cfb92ba334ad6c6051d83ebae88b6a6f53c8b4ada967927a4
ep_bytes: ff25000045008ecf470436bc28a49049
timestamp: 2022-07-17 13:55:58

Version Info:
0: [No Data]

Generic.MSIL.Bladabindi.DFA6E9DD also known as:

How to remove Generic.MSIL.Bladabindi.DFA6E9DD?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.