Malware

About “Generic.MSIL.PasswordStealerA.73AFE6FF” infection

Malware Removal

The Generic.MSIL.PasswordStealerA.73AFE6FF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Generic.MSIL.PasswordStealerA.73AFE6FF virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Anomalous .NET characteristics
  • Uses Windows utilities for basic functionality
  • Uses Windows utilities for basic functionality
  • Creates a copy of itself
  • Harvests cookies for information gathering
  • Harvests credentials from local FTP client softwares
  • Harvests information related to installed instant messenger clients

How to determine Generic.MSIL.PasswordStealerA.73AFE6FF?



File Info:

name: 0313E11BFE4824EA813C.mlw
path: /opt/CAPEv2/storage/binaries/906bc6dd2e0e070675f21e08e2526a63282bbcb7d94602515c25ca92981d8738
crc32: 72C57AE3
md5: 0313e11bfe4824ea813cef91b09b41d2
sha1: decd3add6b5404a939374172cffa6638464f3d29
sha256: 906bc6dd2e0e070675f21e08e2526a63282bbcb7d94602515c25ca92981d8738
sha512: 76d8ab47dde94d55b930ec2ec737d44b31429e3160925174331274ce6180db6cd2bc0b7f333ee3ea69048850d62cfa6761728ec10998985ca41829da68176ee4
ssdeep: 3072:lhurlxKceZde2vBVQF4EWjFRA229YvepcCBKXnpv:lMrlEdeAVQF4EWx92iepcCBKX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16A04282A27ECDD45E0BD4775A7B2278083B8ED079613C70E4AE450F86D377526A063EB
sha3_384: 3d170ab1756a6ce16aaf4412b10d2e00473a8021b690536a7b37db4f864a0337b0e64d308cb589062ed7da187169237b
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-10-23 11:12:29


Version Info:

Translation: 0x0000 0x04b0
Comments: Rn3lQwEGxwzoaCDjhTcHbg6muJO6UW
CompanyName: 1fnUaIl6zZpzsz4DzFOvKZyoXX5Js7
FileDescription: 9t33GLLtUNMlL3Jy8imKDM4u6xJVI6
FileVersion: 9.7.4.7
InternalName: assemblychange.exe
LegalCopyright: rmqevvh7O80FTT1PxOYYdKuENpyDwo
LegalTrademarks: mcaF6AxbZP9HLI8447xqkmK4We86uN
OriginalFilename: assemblychange.exe
ProductName: VHiCtYXnfNlXvaZ87psouU9Y8b9SY4
ProductVersion: 9.7.4.7
Assembly Version: 9.7.2.6

Generic.MSIL.PasswordStealerA.73AFE6FF also known as:

BkavW32.AIDetectNet.01
LionicTrojan.Win32.Generic.lXjy
Elasticmalicious (high confidence)
DrWebTrojan.DownLoader9.27474
MicroWorld-eScanGeneric.MSIL.PasswordStealerA.73AFE6FF
FireEyeGeneric.mg.0313e11bfe4824ea
CAT-QuickHealBackdoor.Bladabindi.AL3
McAfeePWS-FDEC!0313E11BFE48
CylanceUnsafe
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 700000121 )
AlibabaTrojanPSW:MSIL/Mintluks.14b51d6a
K7GWTrojan ( 700000121 )
Cybereasonmalicious.bfe482
BitDefenderThetaGen:NN.ZemsilF.34726.lm0@a0eBFij
VirITTrojan.Win32.MSIL.MKJ
CyrenW32/MSIL_Mintluks.A.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Bladabindi.AT
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Dropper.njRAT-7400469-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGeneric.MSIL.PasswordStealerA.73AFE6FF
NANO-AntivirusTrojan.Win32.MlwGen.dckdxu
AvastMSIL:KillAV-B [Trj]
TencentTrojan.Win32.Bladabindi.16000442
Ad-AwareGeneric.MSIL.PasswordStealerA.73AFE6FF
EmsisoftGeneric.MSIL.PasswordStealerA.73AFE6FF (B)
ComodoTrojWare.MSIL.Bladabindi.W@8alt75
F-SecureMalware.LNK/Runner.VPGD
VIPREGeneric.MSIL.PasswordStealerA.73AFE6FF
TrendMicroBKDR_BLADABI.SMF
McAfee-GW-EditionPWS-FDEC!0313E11BFE48
SophosML/PE-A + Mal/Bladabi-P
SentinelOneStatic AI – Malicious PE
JiangminTrojan/Generic.aztew
GoogleDetected
AviraLNK/Runner.VPGD
Antiy-AVLTrojan/Win32.AGeneric
MicrosoftPWS:MSIL/Mintluks.A
ArcabitGeneric.MSIL.PasswordStealerA.73AFE6FF
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataMSIL.Backdoor.Motnav.A
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Generic.C263497
Acronissuspicious
ALYacGeneric.MSIL.PasswordStealerA.73AFE6FF
MAXmalware (ai score=87)
MalwarebytesHackTool.Agent.ACGen
TrendMicro-HouseCallBKDR_BLADABI.SMF
RisingBackdoor.njRAT!1.9E49 (CLASSIC)
YandexTrojan.Agent!dB2uxHYGBX8
IkarusWorm.MSIL.Bladabindi
MaxSecureTrojan.Malware.300983.susgen
FortinetMSIL/SpyPSW.AVQ!tr
AVGMSIL:KillAV-B [Trj]
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Generic.MSIL.PasswordStealerA.73AFE6FF?

Generic.MSIL.PasswordStealerA.73AFE6FF removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment