Categories: Malware

About “Mal/Generic-R + Mal/Emogen-H” infection

The Mal/Generic-R + Mal/Emogen-H is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/Generic-R + Mal/Emogen-H virus can do?

Behavioural detection: Executable code extraction – unpacking
SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Anomalous file deletion behavior detected (10+)
Guard pages use detected – possible anti-debugging.
A process attempted to delay the analysis task.
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Spanish (Modern)
Authenticode signature is invalid
Installs itself for autorun at Windows startup
Attempts to modify proxy settings
Harvests cookies for information gathering

Related domains:

wpad.local-net

pke.com.mx

How to determine Mal/Generic-R + Mal/Emogen-H?


File Info:
name: F0D3C265CA1F3ED92A2B.mlwpath: /opt/CAPEv2/storage/binaries/104ab0c56050ff0700a092cf57d765191e559f81b9b222ccb89483dece87621fcrc32: 69233695md5: f0d3c265ca1f3ed92a2ba96b9eedf2d2sha1: e91c7b8103409f0aa5512a97f465e55c5be9e42csha256: 104ab0c56050ff0700a092cf57d765191e559f81b9b222ccb89483dece87621fsha512: dd5072f99cb18c2ea7d73db3ef9e7e8d5e79c9b2914654b2ec2fc261b820acd3ea410a0e50b050e0293350a9cb2c78077a1cac2169670f5c546b20a00eb3e9f2ssdeep: 768:xjmOsjBOFaCg4Smv+cma5Zn2o30zUA4gaX5yP/CWqFVRIWdH:xS9OFaCp+0Ln2QCogaXcnCWqFVRIWJtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T147631A2BFE483421E94948B25C5596E53D27BD261601DE4F6152FE6E2C32A83BCF431Fsha3_384: 1159a1135d965479fff5e2d01e151ad9d3559a8b5a9dfe42bd673c36c040ea7997d867cb11fa6bf81b2b1d7726d91d9aep_bytes: 68c4244000e8eeffffff000000000000timestamp: 2021-03-28 01:29:47
Version Info:
Translation: 0x0c0a 0x04b0CompanyName: .ProductName: sPSvrFileVersion: 1.00ProductVersion: 1.00InternalName: sPSvrOriginalFilename: sPSvr.exe

Mal/Generic-R + Mal/Emogen-H also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.47478801
FireEye	Trojan.GenericKD.47478801
McAfee	Artemis!F0D3C265CA1F
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
BitDefenderTheta	Gen:NN.ZevbaCO.34294.em0@ae7iBqO
Symantec	ML.Attribute.HighConfidence
TrendMicro-HouseCall	TROJ_GEN.R002C0RKP21
Paloalto	generic.ml
BitDefender	Trojan.GenericKD.47478801
Avast	Win32:Malware-gen
Ad-Aware	Trojan.GenericKD.47478801
Sophos	Mal/Generic-R + Mal/Emogen-H
TrendMicro	TROJ_GEN.R002C0RKP21
McAfee-GW-Edition	BehavesLike.Win32.BadFile.kt
Emsisoft	Trojan.GenericKD.47478801 (B)
Ikarus	Trojan.VB.Downloader
GData	Trojan.GenericKD.47478801
Avira	TR/VB.Downloader.Gen
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.47478801
MAX	malware (ai score=81)
APEX	Malicious
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_60% (W)
MaxSecure	Trojan.Malware.300983.susgen