Generic.Remcos.79F6FA91 (file analysis)

The Generic.Remcos.79F6FA91 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Remcos.79F6FA91 virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Detected script timer window indicative of sleep style evasion
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
A scripting utility was executed
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Creates a hidden or system file
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

dxb1.mooo.com

How to determine Generic.Remcos.79F6FA91?


File Info:
crc32: 83FBB310
md5: 15e1af69cdf75ef8744199cd3ce8cc17
name: 15E1AF69CDF75EF8744199CD3CE8CC17.mlw
sha1: 7b2c78ef712809875f2fc6daa74b08a173e5c50e
sha256: 86992692d34557946a1fd9a96b11789d1ba43b74eb41eeb99181c53ec8c0840c
sha512: 085e7165d76d6a4564a118e5cdc73acf471daa27d5ba192051f8c2e0f103ee97b038642075e6f47ca48cd4ae71bd16b82ffb657baab497f293f06c1df33ed007
ssdeep: 3072:m4XgM0gTUJNFbnOabI/JZ7k0qvo7wvdbnrlSl26FaqmrzqhE1adA2hr5:ZXgMtwNFbOabI/qxlSl26FaFrzqhEu5
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Generic.Remcos.79F6FA91 also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Generic.Remcos.79F6FA91
FireEye	Generic.mg.15e1af69cdf75ef8
McAfee	Remcos-FCTX!15E1AF69CDF7
Cylance	Unsafe
K7AntiVirus	Trojan ( 0053ac2c1 )
BitDefender	Generic.Remcos.79F6FA91
K7GW	Trojan ( 0053ac2c1 )
CrowdStrike	win/malicious_confidence_100% (D)
Cyren	W32/Trojan.QSIV-4823
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:RemcosRAT-A [Trj]
ClamAV	Win.Trojan.Remcos-9753190-0
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Rescoms.hweqnt
ViRobot	Backdoor.Win32.Remcos.139264
Rising	Backdoor.Remcos!1.B6A7 (CLASSIC)
Ad-Aware	Generic.Remcos.79F6FA91
Emsisoft	Trojan.Rescoms (A)
Comodo	TrojWare.Win32.Rescoms.B@7ijo3m
F-Secure	Backdoor.BDS/Backdoor.Gen
DrWeb	Trojan.DownLoader33.63577
TrendMicro	BKDR_SOCMER.SM
McAfee-GW-Edition	BehavesLike.Win32.Generic.cm
Sophos	ML/PE-A + Mal/Emogen-Y
Ikarus	Backdoor.Remcos
Jiangmin	Trojan.Generic.glrlr
Avira	BDS/Backdoor.Gen
MAX	malware (ai score=86)
Antiy-AVL	Trojan[Backdoor]/Win32.Rescoms
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Backdoor:Win32/Rescoms.C!bit
Gridinsoft	Backdoor.Win32.Remcos.oa!s1
Arcabit	Generic.Remcos.79F6FA91
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Win32.Malware.Bucaspys.B
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Remcos.R291256
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34700.iuW@aOBWo0pi
ALYac	Generic.Remcos.79F6FA91
VBA32	BScope.Backdoor.Rescoms
Malwarebytes	Backdoor.Remcos
ESET-NOD32	a variant of Win32/Rescoms.B
TrendMicro-HouseCall	BKDR_SOCMER.SM
Tencent	Malware.Win32.Gencirc.10ce0c50
Yandex	Trojan.Agent!3IydndM9GqU
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Rescoms.B!tr
AVG	Win32:RemcosRAT-A [Trj]
Cybereason	malicious.9cdf75
Paloalto	generic.ml
Qihoo-360	HEUR/QVM07.1.45C2.Malware.Gen

How to remove Generic.Remcos.79F6FA91?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Generic.Remcos.79F6FA91 (file analysis)