Categories: Malware

About “Generic.MSIL.Bladabindi.F25B649C (B)” infection

The Generic.MSIL.Bladabindi.F25B649C (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.MSIL.Bladabindi.F25B649C (B) virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Reads data out of its own binary image
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Uses Windows utilities for basic functionality
Sniffs keystrokes
A process was set to shut the system down when terminated
Installs itself for autorun at Windows startup
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

relaxs.ddns.net

How to determine Generic.MSIL.Bladabindi.F25B649C (B)?


File Info:
crc32: 53CC6550md5: aaeca418342e11263d632738d59e873bname: AAECA418342E11263D632738D59E873B.mlwsha1: 93ac62663d5e591fa73681863e7a34accdb4e8bfsha256: 36319ca283ce2aed7197a8bde4854fdcd23dd03d764228a7b542ffef12b68e6dsha512: 01cf7e796cfce2769ec685413e12bb26551005062155347faabbf8e540303b33f07ac9fae984ac5759974feed767da6a932b356313c60fb653aa1ca0332aa9c9ssdeep: 12288:LQWXNE+HFbJEXh0ELbXa5j1gqsaPgCs1B:8AltEuIbK5j1maICs1type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Version Info:
0: [No Data]

Generic.MSIL.Bladabindi.F25B649C (B) also known as:

K7AntiVirus	Trojan ( 7000001c1 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Generic.MSIL.Bladabindi.F25B649C
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Trojan ( 7000001c1 )
Cybereason	malicious.8342e1
Baidu	MSIL.Backdoor.Bladabindi.a
Cyren	W32/MSIL_Agent.BTF.gen!Eldorado
Symantec	Backdoor.Ratenjay
ESET-NOD32	a variant of MSIL/Agent.CWR
APEX	Malicious
Avast	MSIL:Agent-DRD [Trj]
ClamAV	Win.Dropper.njRAT-7436651-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Generic.MSIL.Bladabindi.F25B649C
MicroWorld-eScan	Generic.MSIL.Bladabindi.F25B649C
Ad-Aware	Generic.MSIL.Bladabindi.F25B649C
Sophos	ML/PE-A + Troj/Bbindi-W
BitDefenderTheta	Gen:NN.ZemsilF.34170.HuW@aGVwR8i
VIPRE	Backdoor.MSIL.Bladabindi.a (v)
TrendMicro	BKDR_BLADABI.SMC
McAfee-GW-Edition	BehavesLike.Win32.Generic.hh
FireEye	Generic.mg.aaeca418342e1126
Emsisoft	Generic.MSIL.Bladabindi.F25B649C (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/Dropper.Gen2
eGambit	Unsafe.AI_Score_95%
Microsoft	Backdoor:MSIL/Bladabindi.AJ
Arcabit	Generic.MSIL.Bladabindi.F25B649C
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	MSIL.Trojan-Spy.Bladabindi.BQ
AhnLab-V3	Trojan/Win.Generic.C4589889
McAfee	BackDoor-FDNN!AAECA418342E
MAX	malware (ai score=80)
TrendMicro-HouseCall	BKDR_BLADABI.SMC
Rising	Backdoor.Njrat!1.9E49 (CLASSIC)
Ikarus	Trojan.MSIL.Bladabindi
Fortinet	MSIL/Agent.LI!tr
AVG	MSIL:Agent-DRD [Trj]