Categories: Malware

Mal/Generic-R + Mal/Wanna-A removal instruction

The Mal/Generic-R + Mal/Wanna-A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/Generic-R + Mal/Wanna-A virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Presents an Authenticode digital signature
A process attempted to delay the analysis task.
Attempts to connect to a dead IP:Port (1042 unique times)
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
HTTPS urls from behavior.
Reads data out of its own binary image
A process created a hidden window
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Installs itself for autorun at Windows startup
Installs itself for autorun at Windows startup
Creates a hidden or system file

How to determine Mal/Generic-R + Mal/Wanna-A?


File Info:
name: CCBD3A1ACDF662C4C556.mlwpath: /opt/CAPEv2/storage/binaries/a7c3ce181e5c3956bb6b9b92e862b6fea6d6d3be1a38321ebb84428dde127677crc32: A38FDB3Fmd5: ccbd3a1acdf662c4c556fceada101b84sha1: c39214bdc7709bccdb1b08d8379a28023786a1ecsha256: a7c3ce181e5c3956bb6b9b92e862b6fea6d6d3be1a38321ebb84428dde127677sha512: 823b5007bf194cc8995a42281ae28479dc0452138d62d0a6712540869b7474b9b88fc88f9e6c5d4343696bbbfbcbdd0c6ec5f75f0d6298122c970088bb85dcabssdeep: 98304:dDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3S:dDqPe1Cxcxk3ZAEUadzR8yc4gitype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14C0633A8961DA1BCF0050EB084928557DBBB3C57B7FA592FCF8045660E43B6F9BC0E61sha3_384: 6b107e9a323838bb1e7e0ba2c04aba1ac5e704147bd32aed7e237bc5f86404b4e0414d3a0f1bfb4bb2fec04088a5fccaep_bytes: 558bec6aff68a0a1400068a29b400064timestamp: 2010-11-20 09:03:08
Version Info:
CompanyName: Microsoft CorporationFileDescription: Microsoft® Disk DefragmenterFileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)InternalName: lhdfrgui.exeLegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: lhdfrgui.exeProductName: Microsoft® Windows® Operating SystemProductVersion: 6.1.7601.17514Translation: 0x0409 0x04b0

Mal/Generic-R + Mal/Wanna-A also known as:

Lionic	Trojan.Win32.Wanna.toNz
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Ransom.WannaCryptor.H
FireEye	Generic.mg.ccbd3a1acdf662c4
CAT-QuickHeal	Ransom.Zenshirsh.SL8
McAfee	Ransom-WannaCry!CCBD3A1ACDF6
Cylance	Unsafe
K7AntiVirus	Exploit ( 0050d7a31 )
K7GW	Exploit ( 0050d7a31 )
Cybereason	malicious.acdf66
Baidu	Win32.Worm.Rbot.a
VirIT	Trojan.Win32.WannaCry.B
Cyren	W32/Trojan.ZTSA-8671
Symantec	Trojan.Malfilter
ESET-NOD32	Win32/Exploit.CVE-2017-0147.A
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Ransomware.Wanna-9769986-0
Kaspersky	Trojan-Ransom.Win32.Wanna.m
BitDefender	Trojan.Ransom.WannaCryptor.H
NANO-Antivirus	Trojan.Win32.Wanna.epclsl
Avast	Sf:WNCryLdr-A [Trj]
Tencent	Trojan.Win32.WannaCry.b
Ad-Aware	Trojan.Ransom.WannaCryptor.H
Sophos	Mal/Generic-R + Mal/Wanna-A
Comodo	TrojWare.Win32.WannaCry.jet@714um4
F-Secure	Trojan.TR/Ransom.JB
DrWeb	Trojan.Encoder.11432
Zillya	Trojan.WannaCry.Win32.1
TrendMicro	Ransom_WCRY.SMALYM
McAfee-GW-Edition	Ransom-WannaCry!CCBD3A1ACDF6
Emsisoft	Trojan.Ransom.WannaCryptor.H (B)
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan-Ransom.WannaCry.D
Jiangmin	Trojan.WanaCry.i
Webroot	W32.Ransom.Wannacry
Avira	TR/Ransom.JB
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.20277B2
ViRobot	Trojan.Win32.WannaCry.3723264.A
Microsoft	Ransom:Win32/WannaCrypt.H
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.WannaCryptor.R200572
ALYac	Trojan.Ransom.WannaCryptor
TACHYON	Ransom/W32.WannaCry.Zen
VBA32	TrojanRansom.Wanna
TrendMicro-HouseCall	Ransom_WCRY.SMALYM
Yandex	Trojan.Igent.bUj9pX.12
Ikarus	Exploit.CVE-2017-0147
MaxSecure	Trojan-Ransom.Win32.Wanna.m
Fortinet	W32/WannaCryptor.H!tr.ransom
BitDefenderTheta	Gen:NN.ZexaF.34606.wt0@aGEmS3di
AVG	Sf:WNCryLdr-A [Trj]
Panda	Trj/RansomCrypt.I
CrowdStrike	win/malicious_confidence_100% (W)