Categories: Malware

Mal/EncPk-ABZ removal guide

The Mal/EncPk-ABZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/EncPk-ABZ virus can do?

Executable code extraction
Injection with CreateRemoteThread in a remote process
Creates RWX memory
Starts servers listening on 0.0.0.0:28212, :0
Reads data out of its own binary image
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Uses Windows utilities for basic functionality
Code injection with CreateRemoteThread in a remote process
Deletes its original binary from disk
Tries to unhook or modify Windows functions monitored by Cuckoo
Steals private information from local Internet browsers
Installs itself for autorun at Windows startup
Creates a hidden or system file
Creates Zeus (Banking Trojan) mutexes
Zeus P2P (Banking Trojan)
Attempts to modify proxy settings
Attempts to modify browser security settings
Harvests credentials from local FTP client softwares
Attempts to interact with an Alternate Data Stream (ADS)
Creates a slightly modified copy of itself
Collects information to fingerprint the system
Clears web history

How to determine Mal/EncPk-ABZ?


File Info:
crc32: 86B0F485md5: 3b3baad481c960e945ec8d3f81453c5ename: deltax.exesha1: e2c613b54764ba0078ee5575df105b7f62e28930sha256: 4a5566975893e6df1c42c57a5671cf4a18cb0e35613fb894a6341b9cfd95c877sha512: d14317dead7d548876caecdc9002a39972b2e197a2c91e2cf0a8bbe2f0ab0fb2ec2e88ce9d8a53ad776ec3787faa187e0b80026014d78c0c1b81d667175225bdssdeep: 6144:Jc8kGltuYVPoQysh2IINj7eirtbTKZGzZLTPrmAzRWBr4Z1vM/5K9:JYGltuUP7yqoictbTKZitlWBkTMtype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
0: [No Data]

Mal/EncPk-ABZ also known as:

MicroWorld-eScan	Gen:Variant.Razy.448283
CAT-QuickHeal	TrojanPWS.Zbot.Y
McAfee	Artemis!3B3BAAD481C9
Cylance	Unsafe
VIPRE	Trojan.Win32.EncPk.gen.abz (v)
AegisLab	Trojan.Win32.Generic.4!c
Sangfor	Malware
CrowdStrike	win/malicious_confidence_90% (W)
BitDefender	Gen:Variant.Razy.448283
K7GW	Trojan ( 0055dd191 )
K7AntiVirus	Trojan ( 0055dd191 )
Baidu	Win32.Trojan.Kryptik.afi
ESET-NOD32	a variant of Win32/Kryptik.ACOO
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	TrojanPSW:Win32/Kryptik.db68b2e7
NANO-Antivirus	Trojan.Win32.Panda.dmjbbi
Tencent	Win32.Trojan.Generic.Lked
Ad-Aware	Gen:Variant.Razy.448283
Emsisoft	Gen:Variant.Razy.448283 (B)
Comodo	TrojWare.Win32.Kryptik.YNW@4m7jur
F-Secure	Trojan.TR/Crypt.ULPM.Gen
DrWeb	Trojan.PWS.Panda.1577
Zillya	Trojan.Kryptik.Win32.1888393
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.PUPXAX.dc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.3b3baad481c960e9
Sophos	Mal/EncPk-ABZ
Ikarus	Virus.Win32.Cryptor
Jiangmin	Trojan/Generic.bainr
Avira	TR/Crypt.ULPM.Gen
MAX	malware (ai score=100)
Microsoft	PWS:Win32/Zbot.gen!rfn
Endgame	malicious (moderate confidence)
Arcabit	Trojan.Razy.D6D71B
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Razy.448283
AhnLab-V3	Spyware/Win32.Zbot.R20155
Acronis	suspicious
VBA32	BScope.Trojan.Zbot.01615
ALYac	Gen:Variant.Razy.448283
Panda	Trj/Genetic.gen
Rising	Trojan.Generic!8.C3 (CLOUD)
Yandex	Trojan.Agent!n+Z26gS0LN0
SentinelOne	DFI – Malicious PE
MaxSecure	Trojan.Malware.7164915.susgen
Fortinet	W32/Kryptik.HZ!tr
BitDefenderTheta	Gen:NN.ZexaF.34098.smGfam5riLi
AVG	Win32:Injector-AMN [Trj]
Cybereason	malicious.481c96
Avast	Win32:Injector-AMN [Trj]
Qihoo-360	Generic/Trojan.58e