Generik.ENXPHJC malicious file

Malware Removal

The Generik.ENXPHJC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Generik.ENXPHJC virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Injection with CreateRemoteThread in a remote process
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Reads data out of its own binary image
  • A process created a hidden window
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Attempts to remove evidence of file being downloaded from the Internet
  • Executed a process and injected code into it, probably while unpacking
  • Installs itself for autorun at Windows startup
  • Exhibits behavior characteristic of Nanocore RAT
  • Creates a copy of itself
  • Collects information to fingerprint the system

Related domains:

z.whorecord.xyz
a.tomx.xyz
cloudhost.myfirewall.org

How to determine Generik.ENXPHJC?


File Info:

crc32: 6F6D66BD
md5: 0bbcc2e64e3edf053ed4af2c0bafb0eb
name: 0BBCC2E64E3EDF053ED4AF2C0BAFB0EB.mlw
sha1: c006b8d2ec4b92f441815b20f1bdadf98eab1b4d
sha256: 52d01903f7c366e01359a00ea771ca1f71d4e1bb54731290bc62c3a218f5af80
sha512: 0bed9ac8299a16ba8f9defa6160a97654b08c86bf038367fc5508a90240c5801320955dca4d452fd7e41f16cc1a71a20ac0a946d80101dc65e9495c15f98ef3c
ssdeep: 6144:x/7jHNyWI+b1m3N2teCoTpkB/Bm8V/7bLf8q2/MQo1m1dupfmndJLvG:fEaE3N20CBTHU/Noydupf2
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:

Translation: 0x0000 0x04b0
LegalCopyright: 2013-2021 (C) Blackboard Learn
Assembly Version: 16.60.0.4
InternalName: x629x6350x9996x698x67eFx62bDM.exe
FileVersion: 16.69.0.4
CompanyName: Blackboard Learn
LegalTrademarks:
Comments: Moodle
ProductName: Student Studio
ProductVersion: 16.69.0.4
FileDescription: Student Studio
OriginalFilename: x629x6350x9996x698x67eFx62bDM.exe

Generik.ENXPHJC also known as:

Elasticmalicious (high confidence)
DrWebTrojan.Packed2.42850
CylanceUnsafe
SangforTrojan.Win32.Save.a
BitDefenderThetaGen:NN.ZemsilCO.34574.zm0@ayE8PAo
CyrenW32/MSIL_Kryptik.DFR.gen!Eldorado
SymantecScr.Malcode!gdn30
APEXMalicious
KasperskyUDS:DangerousObject.Multi.Generic
McAfee-GW-EditionBehavesLike.Win32.Generic.gc
FireEyeGeneric.mg.0bbcc2e64e3edf05
SophosML/PE-A
SentinelOneStatic AI – Malicious PE
MicrosoftTrojan:Win32/Wacatac.B!ml
ZoneAlarmUDS:DangerousObject.Multi.Generic
CynetMalicious (score: 100)
McAfeeArtemis!0BBCC2E64E3E
MalwarebytesMalware.AI.3741603319
ESET-NOD32a variant of Generik.ENXPHJC
CrowdStrikewin/malicious_confidence_80% (D)
MaxSecureTrojan.Malware.300983.susgen

How to remove Generik.ENXPHJC?

Generik.ENXPHJC removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment