Malware

Mal/Generic-R + Mal/ZbotAI-A malicious file

Malware Removal

The Mal/Generic-R + Mal/ZbotAI-A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Mal/Generic-R + Mal/ZbotAI-A virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Authenticode signature is invalid

How to determine Mal/Generic-R + Mal/ZbotAI-A?



File Info:

name: B700D0A4B4C16813ABC3.mlw
path: /opt/CAPEv2/storage/binaries/e49861a4de44de703918314ed21bc459b07ffe8e2ddb3fe27c48e4b0a6a33011
crc32: 98434608
md5: b700d0a4b4c16813abc37b58dffaf9b8
sha1: 8130b532dd7b6212bb43234520a66ddaa53c6de3
sha256: e49861a4de44de703918314ed21bc459b07ffe8e2ddb3fe27c48e4b0a6a33011
sha512: d3705f158690517c3941abef31d935e52c17c7ee97a656f22d3b931fa2132cf48ddeabae111caf028a8f1220cc4f5aecd1a4b68347033cf426b68d3599a892ed
ssdeep: 12288:mCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBga+nZQ:mCdxte/80jYLT3U1jfsWa+nZQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T105058C2273DDC360CB769173BF69B7016EBF78650630B85B2F880D79A950171262DBA3
sha3_384: 5dc6c8a552f068ecab53ee4b95baea308eff4dd7b70fe8ee0d5752197579fbe3fe6911d153a3521a6aabdf34bafbcadd
ep_bytes: e8b8d00000e97ffeffffcccccccccccc
timestamp: 2021-11-23 14:47:42


Version Info:

CompanyName: SgbIsHidR
FileVersion: 0.0.0.0
Translation: 0x0809 0x04b0

Mal/Generic-R + Mal/ZbotAI-A also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.Generic.4!e
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.38129925
FireEyeTrojan.GenericKD.38129925
McAfeeArtemis!B700D0A4B4C1
K7AntiVirusTrojan ( 0054bc841 )
AlibabaTrojan:Win32/Predator.95638f2b
K7GWTrojan ( 0054bc841 )
CrowdStrikewin/malicious_confidence_70% (W)
CyrenW32/AutoIt.SQ.gen!Eldorado
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of Win32/Autoit.OGC
APEXMalicious
Paloaltogeneric.ml
KasperskyUDS:Trojan.Script.Generic
BitDefenderTrojan.GenericKD.38129925
AvastAutoIt:Runner-BG [Trj]
Ad-AwareTrojan.GenericKD.38129925
EmsisoftTrojan.GenericKD.38129925 (B)
Comodofls.noname@0
TrendMicroTrojan.AutoIt.VICTORYGATE.SM
McAfee-GW-EditionBehavesLike.Win32.TrojanAitInject.ch
SophosMal/Generic-R + Mal/ZbotAI-A
GDataWin32.Trojan.Agent.76YU7V
AviraWORM/FakeExt.Gen8
Antiy-AVLTrojan/Generic.ASCommon.16F
MicrosoftTrojan:Win32/Predator.AR!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Starter.C2861195
ALYacTrojan.GenericKD.38129925
MAXmalware (ai score=85)
MalwarebytesTrojan.Agent
TrendMicro-HouseCallTrojan.AutoIt.VICTORYGATE.SM
RisingMalware.FakeFolder/ICON!1.D519 (CLASSIC)
FortinetAutoIt/Agent.OGC!tr
AVGAutoIt:Runner-BG [Trj]
MaxSecureTrojan.Malware.300983.susgen

How to remove Mal/Generic-R + Mal/ZbotAI-A?

Mal/Generic-R + Mal/ZbotAI-A removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment