Categories: Malware

Generik.CRANCRB removal instruction

The Generik.CRANCRB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generik.CRANCRB virus can do?

Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
Sample contains Overlay data
Reads data out of its own binary image
Drops a binary and executes it
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities to create a scheduled task
Deletes executed files from disk

How to determine Generik.CRANCRB?


File Info:
name: BF523E69213072F3B60C.mlwpath: /opt/CAPEv2/storage/binaries/eb9149ac7eab8affa2f47202386520c97339ff6023376bba590cfd2fab034815crc32: E8CAFF6Dmd5: bf523e69213072f3b60cdf27f1794247sha1: df3f1b1ef24d070aaa340ab8ad682c2bb7bdadc2sha256: eb9149ac7eab8affa2f47202386520c97339ff6023376bba590cfd2fab034815sha512: 1333af06224399d2c74a457bdfc0230e796537516a53694acc602afc72f55b39559d0621ccd6b5e253f738ba7c4931acafc0e6bb3b3d1400cf29e2bec542b026ssdeep: 12288:wWAdR5K3/3jv02wQIeF8TlUv5QQ+g5MAY0fA8Q:whR5y/zWQbyJiQs2V0IDtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1FAB4235631019476E83E44B158BFAF52E335AE168A5004837BA63FBF1EBD06BC90E747sha3_384: d25348d4cb500a53dbc87ffde9a17f5aa1fbb63a460b4edf53bbfc2d4d362860f5c056763e712308f93a5e9eac217827ep_bytes: 81ec8001000053555633db57895c2418timestamp: 2009-06-18 21:33:27
Version Info:
0: [No Data]

Generik.CRANCRB also known as:

Lionic	Trojan.Win32.PolyRansom.4!c
MicroWorld-eScan	Trojan.GenericKD.31188489
FireEye	Trojan.GenericKD.31188489
ALYac	Trojan.GenericKD.31188489
Malwarebytes	Generic.Malware/Suspicious
VIPRE	Trojan.GenericKD.31188489
Sangfor	Ransom.Win32.Virlock.Vrxj
K7AntiVirus	Trojan ( 0059f9b21 )
Alibaba	Ransom:Win32/PolyRansom.c0842ce2
K7GW	Trojan ( 0059f9b21 )
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	Trojan.Gen.MBT
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Generik.CRANCRB
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Ransom.Win32.PolyRansom.dyt
BitDefender	Trojan.GenericKD.31188489
Avast	Win32:Malware-gen
Tencent	Win32.Trojan-Ransom.Ployransom.Cwnw
Emsisoft	Trojan.GenericKD.31188489 (B)
F-Secure	Heuristic.HEUR/AGEN.1319308
McAfee-GW-Edition	RDN/Ransom
Sophos	AdLoad (PUA)
SentinelOne	Static AI – Suspicious PE
GData	Win32.Trojan-Downloader.Generic.IX0WVJ
Jiangmin	Trojan.PolyRansom.ne
Avira	TR/Ransom.yzeve
MAX	malware (ai score=84)
Antiy-AVL	Trojan[Ransom]/Win32.PolyRansom
Arcabit	Trojan.Generic.D1DBE609
ZoneAlarm	UDS:Trojan-Ransom.Win32.PolyRansom.dyt
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
McAfee	Artemis!BF523E692130
Cylance	unsafe
Rising	Ransom.PolyRansom!8.32D6 (CLOUD)
Ikarus	Trojan.Win32.Occamy
Fortinet	W32/PolyRansom.DYT!tr
BitDefenderTheta	Gen:NN.ZexaF.36164.EyW@ai4HK4gi
AVG	Win32:Malware-gen
Cybereason	malicious.921307
DeepInstinct	MALICIOUS