Mal/Generic-R + Mal/Behav-270 removal guide

Malware Removal

The Mal/Generic-R + Mal/Behav-270 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Mal/Generic-R + Mal/Behav-270 virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (35 unique times)
  • Performs some HTTP requests
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Exhibits possible ransomware file modification behavior
  • Checks for the presence of known devices from debuggers and forensic tools
  • Anomalous binary characteristics

Related domains:

www.ytxxb.com
sdk.51.la
collect-v6.51.la
hm.baidu.com
yulijuan.net
8h8rfq.com
ocsp.globalsign.com
sycdn.comtucdncom.com
apps.identrust.com
ocsp2.globalsign.com
cdn.cangtianbfq.com
fmlb.netlbtu.com
ddcdn.comtucdncom.com
ocsp.digicert.com
ljcdn.comtucdncom.com
statuse.digitalcertvalidation.com
ct.caijinyuan.com
fmtu.netfhtu.com
img.hjimg.com
ct.cangtianbfq.com
bofa.cangtianbfq.com
pic.laoyaimg.com
pornimg.xyz
ct.cqscmy.net
ocsp.comodoca.com
ocsp.usertrust.com
ocsp.sectigo.com
crl.identrust.com
x1.c.lencr.org
r3.o.lencr.org

How to determine Mal/Generic-R + Mal/Behav-270?


File Info:

crc32: D709CE0E
md5: 2d996a888eb23c0d83f7e6c1f90a64f2
name: 2D996A888EB23C0D83F7E6C1F90A64F2.mlw
sha1: e6177c10e24a3fa25c971429acae8a9457c46079
sha256: 9dac5ef2dae03ebb1c3b1711ff23d95796497c1fbd179b8d79fac36468bc34f9
sha512: 10c20ff08659f845c222088ae8e1fd55cbe6fb4ba73de35c8a6da2006ff27ddd019482c4165cf0f7c18f0c1580e1aa549ccbe2c3117577b283705ba28e028aff
ssdeep: 12288:/ZKdpQ17G/IbLA+kvZfGbJF9u7mFuJV3Ee5HrdzF3Z4mxxFY6mcYiaobeORyF:hKHQ16gbLA/vUb7VQV0wRQmXTm963IF
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: copyright (c) 2008 www.ytxxb.com
InternalName: XiXi.exe
FileVersion: 1.0.8.1028
CompanyName: x70dfx53f0x4fe1x606fx5427
LegalTrademarks: x897fx897f(XiXi)
Comments: http://www.ytxxb.com
ProductName: x70dfx53f0x897fx897f
ProductVersion: 1.0.0.0
FileDescription: x70dfx53f0x897fx897fx81f4x529bx4e8ex53d1x5c55x672cx5730x4fe1x606fx4ea7x4e1ax3002
OriginalFilename: XiXi.exe
Translation: 0x0804 0x03a8

Mal/Generic-R + Mal/Behav-270 also known as:

K7AntiVirusTrojan ( 000113461 )
LionicHacktool.Win32.Black.x!c
CynetMalicious (score: 99)
CylanceUnsafe
SangforTrojan.Win32.Black.d
AlibabaPacked:Win32/Black.6df95812
K7GWTrojan ( 000113461 )
ESET-NOD32Win32/Packed.ASProtect.AAB
ZonerProbably Heur.ExeHeaderH
APEXMalicious
AvastWin32:Trojan-gen
KasperskyPacked.Win32.Black.d
SophosMal/Generic-R + Mal/Behav-270
BitDefenderThetaGen:NN.ZexaF.34170.YO0aaupGHigd
McAfee-GW-EditionBehavesLike.Win32.Virus.cc
SentinelOneStatic AI – Suspicious PE
AviraTR/Black.decxg
KingsoftWin32.Troj.Black.(kcloud)
MicrosoftTrojan:Win32/Wacatac.B!ml
ZoneAlarmPacked.Win32.Black.d
GDataWin32.Trojan.Agent.H28YSD
McAfeeArtemis!2D996A888EB2
VBA32BScope.Trojan.Wacatac
TrendMicro-HouseCallTROJ_GEN.R002C0RJ221
IkarusVirus.Win32.Agent.SKP
FortinetW32/Black.D!tr
AVGWin32:Trojan-gen
Paloaltogeneric.ml

How to remove Mal/Generic-R + Mal/Behav-270?

Mal/Generic-R + Mal/Behav-270 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment