Categories: Malware

Generic.Remcos.79F6FA91 (file analysis)

The Generic.Remcos.79F6FA91 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Remcos.79F6FA91 virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Detected script timer window indicative of sleep style evasion
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
A scripting utility was executed
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Creates a hidden or system file
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

dxb1.mooo.com

How to determine Generic.Remcos.79F6FA91?


File Info:
crc32: 83FBB310md5: 15e1af69cdf75ef8744199cd3ce8cc17name: 15E1AF69CDF75EF8744199CD3CE8CC17.mlwsha1: 7b2c78ef712809875f2fc6daa74b08a173e5c50esha256: 86992692d34557946a1fd9a96b11789d1ba43b74eb41eeb99181c53ec8c0840csha512: 085e7165d76d6a4564a118e5cdc73acf471daa27d5ba192051f8c2e0f103ee97b038642075e6f47ca48cd4ae71bd16b82ffb657baab497f293f06c1df33ed007ssdeep: 3072:m4XgM0gTUJNFbnOabI/JZ7k0qvo7wvdbnrlSl26FaqmrzqhE1adA2hr5:ZXgMtwNFbOabI/qxlSl26FaFrzqhEu5type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Generic.Remcos.79F6FA91 also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Generic.Remcos.79F6FA91
FireEye	Generic.mg.15e1af69cdf75ef8
McAfee	Remcos-FCTX!15E1AF69CDF7
Cylance	Unsafe
K7AntiVirus	Trojan ( 0053ac2c1 )
BitDefender	Generic.Remcos.79F6FA91
K7GW	Trojan ( 0053ac2c1 )
CrowdStrike	win/malicious_confidence_100% (D)
Cyren	W32/Trojan.QSIV-4823
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:RemcosRAT-A [Trj]
ClamAV	Win.Trojan.Remcos-9753190-0
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Rescoms.hweqnt
ViRobot	Backdoor.Win32.Remcos.139264
Rising	Backdoor.Remcos!1.B6A7 (CLASSIC)
Ad-Aware	Generic.Remcos.79F6FA91
Emsisoft	Trojan.Rescoms (A)
Comodo	TrojWare.Win32.Rescoms.B@7ijo3m
F-Secure	Backdoor.BDS/Backdoor.Gen
DrWeb	Trojan.DownLoader33.63577
TrendMicro	BKDR_SOCMER.SM
McAfee-GW-Edition	BehavesLike.Win32.Generic.cm
Sophos	ML/PE-A + Mal/Emogen-Y
Ikarus	Backdoor.Remcos
Jiangmin	Trojan.Generic.glrlr
Avira	BDS/Backdoor.Gen
MAX	malware (ai score=86)
Antiy-AVL	Trojan[Backdoor]/Win32.Rescoms
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Backdoor:Win32/Rescoms.C!bit
Gridinsoft	Backdoor.Win32.Remcos.oa!s1
Arcabit	Generic.Remcos.79F6FA91
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Win32.Malware.Bucaspys.B
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Remcos.R291256
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34700.iuW@aOBWo0pi
ALYac	Generic.Remcos.79F6FA91
VBA32	BScope.Backdoor.Rescoms
Malwarebytes	Backdoor.Remcos
ESET-NOD32	a variant of Win32/Rescoms.B
TrendMicro-HouseCall	BKDR_SOCMER.SM
Tencent	Malware.Win32.Gencirc.10ce0c50
Yandex	Trojan.Agent!3IydndM9GqU
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Rescoms.B!tr
AVG	Win32:RemcosRAT-A [Trj]
Cybereason	malicious.9cdf75
Paloalto	generic.ml
Qihoo-360	HEUR/QVM07.1.45C2.Malware.Gen