Malware

Generic.MSIL.PasswordStealerA.C55DDBEA malicious file

Malware Removal

The Generic.MSIL.PasswordStealerA.C55DDBEA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Generic.MSIL.PasswordStealerA.C55DDBEA virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Exhibits behavior characteristic of iSpy Keylogger
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself

Related domains:

z.whorecord.xyz
a.tomx.xyz
nickman12-46565.portmap.io

How to determine Generic.MSIL.PasswordStealerA.C55DDBEA?



File Info:

crc32: E6146DDD
md5: c0b3ea3b93f88f06cd43b31c4950f724
name: upload_file
sha1: 06369131e46e415cbef79553fd0a60e4163c59ea
sha256: 4e963b9768467dcf18787fe4b197a1b9efe76a2108cdf0f73c6f81407c6dca95
sha512: dd5a17f2ce7b16cd9c763456eacb9a7b6df815fe1bade2094aae635c2955a14a0f4389ab3334a560fe128aabbbdae34fe21a35d7328bdffc9db47276692b1295
ssdeep: 24576:IkY4MROxnFZ32kTZUrZlI0AilFEvxHijXF+:Ik7Mi7erZlI0AilFEvxHib
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows


Version Info:

Translation: 0x0000 0x04b0
LegalCopyright: 
Assembly Version: 1.0.0.0
InternalName: OctoSniff.exe
FileVersion: 3.3.0.0
CompanyName: Octolus.net
LegalTrademarks: 
Comments: 
ProductName: OctoSniff
ProductVersion: 3.3.0.0
FileDescription: OctoSniff
OriginalFilename: Orcus.exe

Generic.MSIL.PasswordStealerA.C55DDBEA also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanGeneric.MSIL.PasswordStealerA.C55DDBEA
FireEyeGeneric.mg.c0b3ea3b93f88f06
CAT-QuickHealTrojan.MsilFC.S6051223
McAfeeBackDoor-FDJE!C0B3EA3B93F8
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
AegisLabTrojan.MSIL.Generic.l!c
SangforMalware
K7AntiVirusTrojan ( 005091e91 )
BitDefenderGeneric.MSIL.PasswordStealerA.C55DDBEA
K7GWTrojan ( 005091e91 )
Cybereasonmalicious.b93f88
InvinceaML/PE-A + Troj/Orcusrot-A
BitDefenderThetaGen:NN.ZemsilF.34566.@m0@ay5V@mo
CyrenW32/MSIL_Injector.KK.gen!Eldorado
SymantecTrojan.Sorcurat
ESET-NOD32a variant of MSIL/Orcusrat.D
TrendMicro-HouseCallBKDR_ORCUSRAT.SM
AvastWin32:CrypterX-gen [Trj]
ClamAVWin.Packed.Passwordstealera-9752380-0
KasperskyHEUR:Trojan-Spy.MSIL.Generic
AlibabaWorm:Win32/Ainslot.87c910c5
NANO-AntivirusTrojan.Win32.Orcusrat.hylikx
ViRobotTrojan.Win32.Z.Orcusrat.1041408.A
APEXMalicious
Ad-AwareGeneric.MSIL.PasswordStealerA.C55DDBEA
SophosTroj/Orcusrot-A
Comodo.UnclassifiedMalware@0
F-SecureHeuristic.HEUR/AGEN.1128549
DrWebTrojan.DownLoader24.65022
ZillyaTrojan.Orcusrat.Win32.861
TrendMicroBKDR_ORCUSRAT.SM
McAfee-GW-EditionBackDoor-FDJE!C0B3EA3B93F8
EmsisoftGeneric.MSIL.PasswordStealerA.C55DDBEA (B)
IkarusTrojan.MSIL.Agent
JiangminTrojan.Generic.awmpo
WebrootW32.Trojan.Gen
AviraHEUR/AGEN.1128549
MAXmalware (ai score=80)
Antiy-AVLWorm/Win32.Ainslot
MicrosoftWorm:Win32/Ainslot
ArcabitGeneric.MSIL.PasswordStealerA.C55DDBEA
AhnLab-V3Win-Trojan/OrcusRAT.Exp
ZoneAlarmHEUR:Trojan-Spy.MSIL.Generic
GDataMSIL.Backdoor.Orcus.A
CynetMalicious (score: 90)
ALYacBackdoor.RAT.MSIL.Orcus
MalwarebytesBackdoor.Orcus
ZonerTrojan.Win32.75536
RisingBackdoor.Orcus!1.BABC (CLASSIC)
SentinelOneDFI – Malicious PE
FortinetMSIL/Generic.AP.F529E!tr
AVGWin32:CrypterX-gen [Trj]
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Generic/Trojan.Spy.c29

How to remove Generic.MSIL.PasswordStealerA.C55DDBEA?

Generic.MSIL.PasswordStealerA.C55DDBEA removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment