Categories: Malware

Mal/Generic-R + Mal/EncPk-AIT removal guide

The Mal/Generic-R + Mal/EncPk-AIT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/Generic-R + Mal/EncPk-AIT virus can do?

Behavioural detection: Executable code extraction – unpacking
SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Russian
Authenticode signature is invalid
Collects and encrypts information about the computer likely to send to C2 server
Creates a hidden or system file
Collects information to fingerprint the system

How to determine Mal/Generic-R + Mal/EncPk-AIT?


File Info:
name: 367D930B87B5FD004D10.mlwpath: /opt/CAPEv2/storage/binaries/47923a19f41fab90851b6a824fe8b44c1c766c07f67f07219bc8c68ddfb81efacrc32: D176DD9Dmd5: 367d930b87b5fd004d10b685585ae0d1sha1: 23572e518a1037a482efdf0907b1cff0923628bbsha256: 47923a19f41fab90851b6a824fe8b44c1c766c07f67f07219bc8c68ddfb81efasha512: db71d9912c2d0a9f5dea311382d088e77402769468ba6b96cf93c2402d6baac13fe627dc5a6e6c4196f68a4e6b9d393fd9992bc89cbbf72f150a922205c8c694ssdeep: 3072:BdgNz8NQQJsQdYCppV19PxSzZj4fVsA8iQPWpj:cVaKqpTMj4VEajtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T13D349CD3FB5E411EC447E57CDAC788B9848CAC907A163273358FE15E887E652EA3C681sha3_384: 4d42cf062218aa34464b169206f75ed50e7f774acd36984f58eb15503245039b04a33a9e9307e57df123ad3c757d3618ep_bytes: 558bec5155c745fc97a00000c745fc97timestamp: 2013-03-27 05:24:57
Version Info:
0: [No Data]

Mal/Generic-R + Mal/EncPk-AIT also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.Redirect.140
MicroWorld-eScan	Trojan.Ransom.Cerber.1
FireEye	Generic.mg.367d930b87b5fd00
CAT-QuickHeal	Trojan.Mauvaise.SL1
McAfee	PWS-Zbot-FATG!367D930B87B5
Cylance	Unsafe
Zillya	Trojan.ShipUp.Win32.1166
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Kryptik.9e7f1171
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.b87b5f
BitDefenderTheta	Gen:NN.ZexaF.34182.pqX@auP8TVic
VirIT	Trojan.Win32.Redirect.FK
Cyren	W32/Zbot.JC.gen!Eldorado
Symantec	Packed.Generic.459
ESET-NOD32	a variant of Win32/Kryptik.AXPN
TrendMicro-HouseCall	TROJ_KRYPTK.SMAD
Paloalto	generic.ml
ClamAV	Win.Ransomware.Cerber-5970165-0
Kaspersky	Trojan.Win32.ShipUp.bph
BitDefender	Trojan.Ransom.Cerber.1
NANO-Antivirus	Trojan.Win32.ShipUp.bqoufa
Rising	Trojan.Kryptik!1.AB8B (CLOUD)
TACHYON	Trojan/W32.ShipUp.249144
Emsisoft	Trojan.Ransom.Cerber.1 (B)
Comodo	TrojWare.Win32.Kryptik.AYQE@4wlbfl
Baidu	Win32.Trojan.Agent.eq
VIPRE	Trojan.Win32.Zbot.m (v)
TrendMicro	TROJ_KRYPTK.SMAD
McAfee-GW-Edition	BehavesLike.Win32.Generic.dm
Sophos	Mal/Generic-R + Mal/EncPk-AIT
Ikarus	Trojan.Win32.ShipUp
Jiangmin	Trojan/ShipUp.ig
Avira	TR/Crypt.ZPACK.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.1313D1
Microsoft	Trojan:Win32/Zbot.SIBL!MTB
ViRobot	Trojan.Win32.Z.Kryptik.249144.D
ZoneAlarm	Trojan.Win32.ShipUp.bph
GData	Trojan.Ransom.Cerber.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Shipup.R58811
VBA32	Trojan.ShipUp
ALYac	Trojan.Ransom.Cerber.1
MAX	malware (ai score=84)
Malwarebytes	Trojan.ShipUp
Panda	Trj/Hexas.HEU
APEX	Malicious
Tencent	Trojan-Ransom.Win32.ShipUp.bph
Yandex	Trojan.GenAsa!eLqP2To3Rr0
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.AXRD!tr
AVG	Win32:Gepys-J [Trj]
Avast	Win32:Gepys-J [Trj]
CrowdStrike	win/malicious_confidence_100% (D)