Categories: Malware

Generic.Sdbot.FC44C370 (file analysis)

The Generic.Sdbot.FC44C370 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Sdbot.FC44C370 virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Creates a copy of itself
Anomalous binary characteristics
Yara detections observed in process dumps, payloads or dropped files

How to determine Generic.Sdbot.FC44C370?


File Info:
name: 99AA0B42E07A27EEF94C.mlwpath: /opt/CAPEv2/storage/binaries/098907d9d2e832db449e3fab6a6af99b49fe0b7efd13b5389822d3e019134ad8crc32: CF4AF326md5: 99aa0b42e07a27eef94c80118648dba3sha1: 681a2f94b313d488ad5cb00fbdf5df95242847d2sha256: 098907d9d2e832db449e3fab6a6af99b49fe0b7efd13b5389822d3e019134ad8sha512: 0adb7ff9bc1037313b9938392b5ce578318cec4bbc2dd414c7dec2e9569389e0a5610747a7a2043247d766c34512fd82a725bc3fcd352240735d82d94487fa82ssdeep: 1536:SMcACMbmn1eg94qpQdVU+MGULgwPWuQF0bJy9bZ+RV7QlIJ14YtSUTYc6o7yxswh:LqnCiQfcFIQJy9FwVcy14YtfTYbYyZtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T107A301E644D68011FDAAE6333B6821CBD0A7A520E4BE637BF2EC57853C49B357919703sha3_384: ff119994611eaca1642f43ef346e2651b4d47760a3c5c26ab8ec5f69025d4f449f674c12b2d0545e58131d2e7f5739b0ep_bytes: 535152565755e8000000005d8bd581edtimestamp: 2004-09-08 14:59:17
Version Info:
0: [No Data]

Generic.Sdbot.FC44C370 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Rbot.m!c
MicroWorld-eScan	Generic.Sdbot.FC44C370
FireEye	Generic.mg.99aa0b42e07a27ee
Skyhigh	BehavesLike.Win32.VBObfus.cc
ALYac	Generic.Sdbot.FC44C370
Cylance	unsafe
Zillya	Backdoor.RBot.Win32.54925
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Backdoor ( 00478eb01 )
Alibaba	Backdoor:Win32/Wmfap.fb5c86ee
K7GW	Backdoor ( 00478eb01 )
Cybereason	malicious.2e07a2
Symantec	W32.IRCBot.Gen
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Rbot.AWB
APEX	Malicious
TrendMicro-HouseCall	WORM_SPYBOT.CCF
Kaspersky	Backdoor.Win32.Rbot.gen
BitDefender	Generic.Sdbot.FC44C370
NANO-Antivirus	Trojan.Win32.Rbot.caisid
Avast	Win32:SpyBot-CVU [Trj]
Rising	Backdoor.Rbot!1.6617 (CLOUD)
Emsisoft	Generic.Sdbot.FC44C370 (B)
Google	Detected
F-Secure	Exploit.EXP/DameWare.ggg
DrWeb	BackDoor.Ninja
VIPRE	Generic.Sdbot.FC44C370
TrendMicro	WORM_SPYBOT.CCF
Trapmine	malicious.high.ml.score
CMC	Generic.Win32.99aa0b42e0!MD
Sophos	W32/Rbot-Gen
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor/RBot.ic
Varist	W32/Rbot.G.gen!Eldorado
Avira	EXP/DameWare.ggg
Antiy-AVL	Trojan[Backdoor]/Win32.Rbot
Kingsoft	malware.kb.a.1000
Microsoft	Backdoor:Win32/Rbot
Xcitium	Backdoor.Win32.Rbot.AWB@3ozc
Arcabit	Generic.Sdbot.FC44C370
ZoneAlarm	Backdoor.Win32.Rbot.gen
GData	Generic.Sdbot.FC44C370
Cynet	Malicious (score: 100)
AhnLab-V3	Worm/Win32.IRCBot.C175369
McAfee	W32/Sdbot.k.gen
MAX	malware (ai score=100)
VBA32	OScope.Backdoor.Sdbot.Cgen
Malwarebytes	Malware.Heuristic.2046
Panda	Malicious Packer
Zoner	Probably Heur.ExeHeaderL
Tencent	Malware.Win32.Gencirc.115293db
Yandex	Trojan.GenAsa!hhnT0eeTFWs
Ikarus	Backdoor.Win32.Rbot
MaxSecure	Trojan.Malware.14469.susgen
Fortinet	W32/Small.CJ!tr
BitDefenderTheta	AI:Packer.93FD5C411D
AVG	Win32:SpyBot-CVU [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Backdoor:Win/Rbot.AWB