Categories: Malware

What is “Generic.Zegost.3.247D7862 (B)”?

The Generic.Zegost.3.247D7862 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Zegost.3.247D7862 (B) virus can do?

At least one process apparently crashed during execution
Possible date expiration check, exits too soon after checking local time
Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Creates a copy of itself

Related domains:

1122.haoqing.me

How to determine Generic.Zegost.3.247D7862 (B)?


File Info:
crc32: F84C8150md5: 92b9135780d6ecc14db2f5663418947ename: 360.exesha1: 1cc52fa542fafd1448c1900c75adc52423d9e156sha256: f92bd908be00c1f504e2e08dc7ab4f4a6fda15922fa017b9642ed49868653620sha512: efd36c0eb14a4bfafc704b43c23494dd1f64855964a2cfb00243c11971011e7ffef0703c75e7738c617620324fef1a5a553a1de977c5b96de49af58a797bd552ssdeep: 768:WyKaTvHdeECxsTt2znxwX0lEm9n4IEAdU85mCPlS8DXQ:dvHLCfzikYqU85x3Qtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Microsoft Corp. All rights reserved.InternalName: SQLBROWSERFileVersion: 2011.0110.2100.060 ((SQL11_RTM).120210-1846 )CompanyName: Microsoft CorporationPrivateBuild: LegalTrademarks: Microsoft SQL Server is a registered trademark of Microsoft Corporation.Comments: SQLProductName: Microsoft SQL ServerSpecialBuild: ProductVersion: 11.0.2100.60FileDescription: SQL Server Upgrade EXEOriginalFilename: SQLUpgrade.EXETranslation: 0x0804 0x04b0

Generic.Zegost.3.247D7862 (B) also known as:

MicroWorld-eScan	Generic.Zegost.3.247D7862
FireEye	Generic.mg.92b9135780d6ecc1
CAT-QuickHeal	Trojan.Mauvaise.SL1
ALYac	Generic.Zegost.3.247D7862
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Generic.m64T
Sangfor	Malware
K7AntiVirus	Trojan ( 0053af701 )
BitDefender	Generic.Zegost.3.247D7862
K7GW	Trojan ( 0053af701 )
Cybereason	malicious.780d6e
TrendMicro	BKDR_BEAUGRIT.SM
BitDefenderTheta	Gen:Trojan.Heur.RP.dq0@aK0aYncb
F-Prot	W32/KillAV.AU.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Baidu	Win32.Trojan.Agent.atx
APEX	Malicious
Avast	Win32:Dropper-ODE [Drp]
ClamAV	Win.Trojan.Generic-6305873-0
GData	Generic.Zegost.3.247D7862
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Backdoor:Win32/Zegost.24abe6e7
NANO-Antivirus	Trojan.Win32.Ric.fwtolq
ViRobot	Trojan.Win32.Z.Agent.57344.JXU
Rising	Backdoor.Farfli!1.64B3 (CLASSIC)
Ad-Aware	Generic.Zegost.3.247D7862
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.Fusing.CF@5afr59
F-Secure	Backdoor.BDS/Backdoor.Gen
DrWeb	Trojan.DownLoader26.55235
Zillya	Trojan.Agent.Win32.1144030
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Dropper.qm
Emsisoft	Generic.Zegost.3.247D7862 (B)
SentinelOne	DFI – Malicious PE
Cyren	W32/KillAV.AU.gen!Eldorado
Jiangmin	Heur:Backdoor/PcClient
Avira	BDS/Backdoor.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Backdoor]/Win32.Zegost
Endgame	malicious (high confidence)
Arcabit	Generic.Zegost.3.247D7862
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Backdoor:Win32/Zegost.DA
AhnLab-V3	Trojan/Win32.RL_Zegost.R294275
Acronis	suspicious
McAfee	RDN/Generic BackDoor.ss
VBA32	BScope.Trojan.Agent
Malwarebytes	Trojan.Agent.QQGen
Panda	Generic Malware
ESET-NOD32	a variant of Win32/Agent.QID
TrendMicro-HouseCall	BKDR_BEAUGRIT.SM
Yandex	Trojan.Agent!KO43df1nzLE
Ikarus	Trojan-Downloader.Win32.Agent
Fortinet	W32/Fusing.BB!tr
AVG	Win32:Dropper-ODE [Drp]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	HEUR/QVM07.1.72D9.Malware.Gen