Categories: Malware

Should I remove “Mal/Generic-R + Mal/Behav-156”?

The Mal/Generic-R + Mal/Behav-156 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Mal/Generic-R + Mal/Behav-156 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • Reads data out of its own binary image
  • Manipulates data from or to the Recycle Bin
  • Drops a binary and executes it
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary contains an unknown PE section name indicative of packing
  • Executable file is packed/obfuscated with ASPack
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Installs itself for autorun at Windows startup
  • Installs itself for autorun at Windows startup
  • Created a service that was not started
  • Anomalous binary characteristics

How to determine Mal/Generic-R + Mal/Behav-156?



File Info:

name: ACF8544ACC1315C12ACF.mlwpath: /opt/CAPEv2/storage/binaries/67612b0587c4b2dc07da4e856bc140eba054972bbf6ae6f3dd1bdc697ae5e1b2crc32: 268504ABmd5: acf8544acc1315c12acf76b1327b3a92sha1: fc131ad05bc5c8e6b01a2aba3f5caffde5b828dcsha256: 67612b0587c4b2dc07da4e856bc140eba054972bbf6ae6f3dd1bdc697ae5e1b2sha512: 71e65a2f67452c7998ad02174b0cfb69dab10a6c45c30977bd66a671f6e789a2576df2aa63e8a33198429de422ef9659a192f98c80229fec5cf1519996168cbassdeep: 12288:qb9EkKFFXtIHCjekb9EkKFFXtIHCjekb9EkKFFXtIHCje:q5EFsHC/5EFsHC/5EFsHCtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1CCE412E7478561BDCED880340A6F3E6D1757B15E0B680BD0E2D5EABC3E1A30AF891617sha3_384: 6b8b5f34c7dcaff0ef057315f4febfe0545cd594c3604449b0de0810de1ef17cf4489c60f29033c1f15675f32bf08c58ep_bytes: 60e803000000e9eb045d4555c3e80100timestamp: 1992-06-19 22:22:17

Version Info:

0: [No Data]

Mal/Generic-R + Mal/Behav-156 also known as:

Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.47401452
CAT-QuickHeal Trojan.QqpassPMF.S14264295
ALYac Trojan.GenericKD.47401452
Cylance Unsafe
Zillya Trojan.QQPass.Win32.2179
K7AntiVirus Trojan ( 7000000f1 )
Alibaba Worm:Win32/Fasong.485
K7GW Trojan ( 7000000f1 )
Cybereason malicious.acc131
Baidu Win32.Trojan-PSW.OLGames.bm
Cyren W32/QQPass.GIFW-2105
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Fasong.I
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.Qqpass-172
Kaspersky Trojan.Win32.Reconyc.fxms
BitDefender Trojan.GenericKD.47401452
NANO-Antivirus Trojan.Win32.Reconyc.flewco
Avast Win32:Trojan-gen
Rising Trojan.QPWorkFile (CLASSIC)
Ad-Aware Trojan.GenericKD.47401452
TACHYON Trojan/W32.DP-Reconyc.512000
Emsisoft Trojan.GenericKD.47401452 (B)
DrWeb Trojan.PWS.Qqpass
VIPRE Trojan.Win32.Generic.pak!cobra
TrendMicro TROJ_SPNR.15CG12
McAfee-GW-Edition BehavesLike.Win32.Autorun.jc
FireEye Generic.mg.acf8544acc1315c1
Sophos Mal/Generic-R + Mal/Behav-156
Ikarus Trojan.Small
GData Trojan.GenericKD.47401452
Jiangmin Trojan/PSW.QQPass.7002
Avira TR/QQpass.7002
Antiy-AVL Trojan/Generic.ASMalwS.3D9DAB
Arcabit Trojan.Generic.D2D349EC
ViRobot Trojan.Win32.A.PSW-QQPass.221805[ASPack]
Microsoft PWS:Win32/QQpass.7002
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.QQPass.R57556
McAfee PWS-QQPass
MAX malware (ai score=84)
VBA32 TrojanPSW.QQpass
Malwarebytes Malware.AI.701273177
TrendMicro-HouseCall TROJ_SPNR.15CG12
Tencent Trojan.Win32.BitCoinMiner.la
Yandex Trojan.GenAsa!WhueQjJX3a8
SentinelOne Static AI – Suspicious PE
eGambit Unsafe.AI_Score_99%
Fortinet W32/QQPass.7002!tr
BitDefenderTheta Gen:NN.ZelphiF.34294.ROZba8vqhonb
AVG Win32:Trojan-gen
Panda Trj/Genetic.gen
CrowdStrike win/malicious_confidence_80% (W)
MaxSecure Trojan.Malware.121218.susgen

How to remove Mal/Generic-R + Mal/Behav-156?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment
Share
Published by
Paul Valéry
Tags: Mal/Generic-R + Mal/Behav-156
3 years ago

Recent Posts

MSIL/GenKryptik.GXIZ information

The MSIL/GenKryptik.GXIZ is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

Malware.AI.2789448175 (file analysis)

The Malware.AI.2789448175 is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

Jalapeno.1878 removal instruction

The Jalapeno.1878 is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

What is “Trojan.Heur3.LPT.YmKfaKBcBekib”?

The Trojan.Heur3.LPT.YmKfaKBcBekib is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

How to remove “Worm.Win32.Vobfus.exmt”?

The Worm.Win32.Vobfus.exmt is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

About “TrojanDownloader:Win32/Beebone.JO” infection

The TrojanDownloader:Win32/Beebone.JO is considered dangerous by lots of security experts. When this infection is active,…

2 months ago