Malware

Mal/Generic-R + Troj/Dyreza-FP removal guide

Malware Removal

The Mal/Generic-R + Troj/Dyreza-FP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Mal/Generic-R + Troj/Dyreza-FP virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Anomalous file deletion behavior detected (10+)
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Unconventionial language used in binary resources: Portuguese (Brazilian)
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Behavior consistent with a dropper attempting to download the next stage.
  • Attempts to modify proxy settings
  • Mimics icon used for popular non-executable file format
  • Anomalous binary characteristics

How to determine Mal/Generic-R + Troj/Dyreza-FP?



File Info:

name: D6BDCA6B9744185C4DDE.mlw
path: /opt/CAPEv2/storage/binaries/eaf849d4d4bb584c0064c8165c29074fd30715e5385de80408672211139eadb5
crc32: 897117D9
md5: d6bdca6b9744185c4ddedcf5e51f848d
sha1: c193fc32bf67c8e1d9dc127e3cdb8d95b4f4c078
sha256: eaf849d4d4bb584c0064c8165c29074fd30715e5385de80408672211139eadb5
sha512: 4b32eb879c2b6fcb08c5529167dbb4c5637b54f7c2b2bb91b32ad95cde5f095b4c8ed4e01203f23bd9726cc03bf59a77e9b3c046851129c2f7fdf184c139d952
ssdeep: 1536:eInCFRyAt5kFkUQ2lst+uhyY/tsPbaPfqnEz:eInCqAj+Q2lCEsG4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19D63F7D9F79480F2E122793484328ED3463B782E7E60419B27987639BE76BC18E75346
sha3_384: 7624b42c159df7f9be5b8fce457e9be019b8a1a84dceef497bc35fe641330d9fbe619724beffccb1742289742a4c6dc0
ep_bytes: e8cef2ffffe9b4f3ffffcccccccccccc
timestamp: 2014-04-21 11:39:13


Version Info:

FileDescription: DAVT Corp.
InternalName: DAVT Utility
FileVersion: 1.0.0.10
CompanyName: DAVT
LegalCopyright: Copyright 2014-2015 DAVT
OriginalFilename: davtil.exe
ProductName: DAVT Corp.
ProductVersion: 1.0.0.10
Translation: 0x0423 0x04b1

Mal/Generic-R + Troj/Dyreza-FP also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
DrWebTrojan.Upatre.3504
MicroWorld-eScanTrojan.Upatre.Gen.3
FireEyeGeneric.mg.d6bdca6b9744185c
CAT-QuickHealTrojan.Kadena.B4
ALYacTrojan.Upatre.Gen.3
CylanceUnsafe
VIPRETrojan-Downloader.Win32.Upatre.ic (v)
SangforSuspicious.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaMalware:Win32/Dorpal.ali1000029
K7GWTrojan ( 004c5f921 )
K7AntiVirusTrojan ( 004c75411 )
BitDefenderThetaGen:NN.ZexaF.34294.em1@a47idRmG
CyrenW32/Upatre.AT.gen!Eldorado
SymantecDownloader.Upatre!gen5
ESET-NOD32a variant of Win32/Kryptik.DMJN
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Downloader.Upatre-9909423-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderTrojan.Upatre.Gen.3
SUPERAntiSpywareTrojan.Agent/Gen-Upatre
AvastWin32:Malware-gen
TencentMalware.Win32.Gencirc.10cf357f
Ad-AwareTrojan.Upatre.Gen.3
EmsisoftTrojan.Upatre.Gen.3 (B)
ComodoTrojWare.Win32.TrojanDownloader.Upatre.KMJ@5s5qya
BaiduWin32.Trojan.Kryptik.jn
ZillyaTrojan.Kryptik.Win32.3473211
TrendMicroTROJ_UPATRE.SM37
McAfee-GW-EditionBehavesLike.Win32.Trickbot.lm
SophosMal/Generic-R + Troj/Dyreza-FP
IkarusPUA.Bundler
GDataTrojan.Upatre.Gen.3
JiangminTrojanDownloader.Upatre.npi
AviraTR/Kryptik.abboik
MAXmalware (ai score=81)
Antiy-AVLTrojan/Generic.ASMalwS.349E6B0
ViRobotTrojan.Win32.Z.Upatre.72338
MicrosoftTrojanDownloader:Win32/Upatre
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Upatre.R154505
Acronissuspicious
McAfeeUpatre-FACM!D6BDCA6B9744
VBA32Trojan.Upatre
MalwarebytesTrojan.Upatre
TrendMicro-HouseCallTROJ_UPATRE.SM37
RisingDownloader.Upatre!1.A19D (CLASSIC)
YandexTrojan.DL.Upatre!gq5N1cnMYpQ
SentinelOneStatic AI – Malicious PE
FortinetW32/Waski.A!tr
AVGWin32:Malware-gen
Cybereasonmalicious.b97441
PandaTrj/Genetic.gen
MaxSecureTrojan.Upatre.Gen

How to remove Mal/Generic-R + Troj/Dyreza-FP?

Mal/Generic-R + Troj/Dyreza-FP removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment