Categories: Malware

What is “Generik.BYGLCNI”?

The Generik.BYGLCNI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generik.BYGLCNI virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Attempts to connect to a dead IP:Port (1 unique times)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Enumerates running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
CAPE extracted potentially suspicious content
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Installs itself for autorun at Windows startup
Anomalous binary characteristics

How to determine Generik.BYGLCNI?


File Info:
name: D5F1E38ABA988679E0CA.mlwpath: /opt/CAPEv2/storage/binaries/81cd15c231e6f03c85845f728e02c024238f8dabae1f222584a11e82b56ce9d7crc32: 4B47DE3Dmd5: d5f1e38aba988679e0ca4e9210166b4esha1: fb9e04e44639721979b2696e7dcc0647d35e6c9bsha256: 81cd15c231e6f03c85845f728e02c024238f8dabae1f222584a11e82b56ce9d7sha512: 191478f99542d4201832ee4b77b9ac12794b6f7b3d0d0fd1c3d268bb60222dedb3d42fed8f946428ff99cd783a0b0a87d4b92224eacea634dd7e8d568ed427b8ssdeep: 12288:MBlGIVioZI9X+JYbD2nVzHRxSDD/ITRwwgx5zw:M7VbZI9XbQHR4AYtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T109F49E127690A8F1C15E3D71492ADE64D1FDBC218E68177766D03ABDBE31391BD2C20Esha3_384: 3050cd48356ba9fb2b3854dfb5d731128da5a198814fabd4adc559930ae95d601f1e97c0bd06072258fdba1d9ab8fff4ep_bytes: e872600000e978feffff6a0c68000744timestamp: 2022-03-23 06:19:32
Version Info:
CompanyName: Microsoft CorporationFileDescription: Microsoft(R) Windows(R) Operating SystemFileVersion: 1.2.10.2798InternalName: LOADLegalCopyright: 版权所有 (C) 1986OriginalFilename: LOAD.EXEProductName: 应用程序ProductVersion: 1.2.10.2798Translation: 0x0804 0x04b0

Generik.BYGLCNI also known as:

Lionic	Trojan.Win32.PcClient.m!c
MicroWorld-eScan	Trojan.GenericKD.39846768
FireEye	Trojan.GenericKD.39846768
ALYac	Trojan.GenericKD.39846768
Alibaba	Trojan:Win32/BurHon.09dfdec6
Cybereason	malicious.446397
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Generik.BYGLCNI
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.BurHon.gen
BitDefender	Trojan.GenericKD.39846768
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Burhon.Wtwz
Ad-Aware	Trojan.GenericKD.39846768
Sophos	Mal/Generic-S
TrendMicro	TROJ_GEN.R03BC0WFO22
McAfee-GW-Edition	GenericRXTK-WK!D5F1E38ABA98
Emsisoft	Malware.Generic.CN1 (A)
GData	Trojan.GenericKD.39846768
Avira	TR/Redcap.zivzr
Arcabit	Trojan.Generic.D2600370
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 99)
McAfee	GenericRXTK-WK!D5F1E38ABA98
MAX	malware (ai score=87)
TrendMicro-HouseCall	TROJ_GEN.R03BC0WFO22
Rising	Backdoor.PcClient!8.119 (CLOUD)
Ikarus	Trojan.SuspectCRC
Fortinet	W32/PossibleThreat
BitDefenderTheta	Gen:NN.ZexaF.34742.Tu0@a8enPfhj
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)