Categories: Malware

Generic.Sdbot.4970096D (file analysis)

The Generic.Sdbot.4970096D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Sdbot.4970096D virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Yara detections observed in process dumps, payloads or dropped files

How to determine Generic.Sdbot.4970096D?


File Info:
name: 8977D86AC3C567F1ED7A.mlwpath: /opt/CAPEv2/storage/binaries/dfafb0ed63808056ffebb8bc2e034c30a0a2aa6c69909c9e3a5ddc516aa4d085crc32: 41DAF778md5: 8977d86ac3c567f1ed7a9606fc4e32a8sha1: ad00be223234828a6c690dec6e790496385df425sha256: dfafb0ed63808056ffebb8bc2e034c30a0a2aa6c69909c9e3a5ddc516aa4d085sha512: 87a3cc3ae5bcf739aff6641fa598a47e6e8dbcb7743c0934b4d036964790a21be05aa96ef9a0ccf15d1e9e83dac4460d51529290b8f95bea3ccdf733d56acfd0ssdeep: 3072:hudG3NxdP1LisdRO8qc1LucOzwFEP++Q:gdGBPrR+pktype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1EDA3120AB6B11EB2C953D93FD863094F59E489B32C70CE299F69B8D5D179C214FC0D85sha3_384: 387898ba0114166b3de4f87d84aba93fa99dfb08ea5841528cedab43ff4ee61ea5b9537989e00791a55d62981e7c1304ep_bytes: 60e8edffffffebb3c60dc69363c60ba2timestamp: 2006-03-26 09:47:24
Version Info:
0: [No Data]

Generic.Sdbot.4970096D also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Rbot.m!c
MicroWorld-eScan	Generic.Sdbot.4970096D
ClamAV	Win.Trojan.Mybot-7461
FireEye	Generic.mg.8977d86ac3c567f1
Skyhigh	BehavesLike.Win32.Generic.nc
McAfee	W32/Sdbot.worm.cq.gen.bs
Cylance	unsafe
Zillya	Backdoor.RBot.Win32.20130
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Backdoor:Win32/Wmfap.1359e50f
K7GW	Trojan ( 004bcce41 )
K7AntiVirus	Trojan ( 004bcce41 )
BitDefenderTheta	AI:Packer.9E1DCDC621
VirIT	Backdoor.RBot.QL
Symantec	W32.IRCBot
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Rbot
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.Rbot.akm
BitDefender	Generic.Sdbot.4970096D
NANO-Antivirus	Trojan.Win32.Rbot.puyn
Avast	Win32:Rbot-BRM [Trj]
Tencent	Win32.Backdoor.Rbot.Kmnw
TACHYON	Backdoor/W32.RBot.101376.M
Sophos	W32/Rbot-Gen
F-Secure	Trojan.TR/Crypt.ULPM.Gen
DrWeb	Win32.HLLW.MyBot.based
VIPRE	Generic.Sdbot.4970096D
TrendMicro	WORM_RBOT.ITE
Trapmine	malicious.high.ml.score
Emsisoft	Generic.Sdbot.4970096D (B)
Ikarus	Packed.Win32.PolyCrypt
Jiangmin	Backdoor/Agobot.byy
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/Crypt.ULPM.Gen
Antiy-AVL	Trojan/Win32.Rbot
Kingsoft	Win32.Hack.Rbot.akm
Microsoft	Backdoor:Win32/IRCbot.gen!Z
Xcitium	Packed.Win32.MUPX.Gen@24tbus
Arcabit	Generic.Sdbot.D4BD670D
ViRobot	Backdoor.Win32.RBot.101376.V
ZoneAlarm	Backdoor.Win32.Rbot.akm
GData	Generic.Sdbot.4970096D
Varist	W32/Rbot.P.gen!Eldorado
AhnLab-V3	Worm/Win32.IRCBot.C20576
VBA32	SScope.Backdoor.SdBot.yx
ALYac	Generic.Sdbot.4970096D
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware/Suspicious
Panda	Malicious Packer
Zoner	Probably Heur.ExeHeaderL
TrendMicro-HouseCall	WORM_RBOT.ITE
Rising	Backdoor.Rbot!8.2D8 (TFE:4:zK6F5OAcBuP)
Yandex	Worm.Rbot!ZPbQArHr6p0
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.50798.susgen
AVG	Win32:Rbot-BRM [Trj]
DeepInstinct	MALICIOUS