Categories: Malware

Should I remove “Mal/Generic-R + Troj/Luiha-M”?

The Mal/Generic-R + Troj/Luiha-M is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/Generic-R + Troj/Luiha-M virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Executable file is packed/obfuscated with MPRESS
Authenticode signature is invalid
Installs itself for autorun at Windows startup
Likely virus infection of existing system binary
Anomalous binary characteristics

How to determine Mal/Generic-R + Troj/Luiha-M?


File Info:
name: 78ABE987E85714A6BAC3.mlwpath: /opt/CAPEv2/storage/binaries/8bebb4534aeab51cfea74caa435e777dc864b0a7da2cb2203e8c24ac8ea53affcrc32: 24C2CF00md5: 78abe987e85714a6bac366c43407c2cfsha1: ea9f9a9d5b4aa6703bad204f11df6bcf538b804dsha256: 8bebb4534aeab51cfea74caa435e777dc864b0a7da2cb2203e8c24ac8ea53affsha512: 83913d841d3faa87f961eb9585ce548639d63fcea12565ff1e7c184268023a73c190874e4ed35ab4c04fac40a0f3793b1fdd926a1070136e856722b013dbe749ssdeep: 1536:BxnhmuHsywOKwrpE4AMqfi6HgUu/lED30URnOWoNzDqrjDmgho:3A+lpRqfcUuNEgGeqrGNtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10593F266524D9E4AE245933AC10BF0E70CE55C4F2192A72EC7C679FB7CA0514DBCFA60sha3_384: 994d209581aa1037883368cb4e501151a7031ad2ec40e12fed4ed173872db1c9902986f076367ce7873ab652775b7c30ep_bytes: 60e80000000058055a0b00008b3003f0timestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

Mal/Generic-R + Troj/Luiha-M also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
ClamAV	Win.Trojan.Wabot-9783917-0
FireEye	Generic.mg.78abe987e85714a6
McAfee	GenericRXAA-AA!78ABE987E857
Cylance	Unsafe
Zillya	Backdoor.Wabot.Win32.2319
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0052964f1 )
BitDefender	Trojan.GenericKD.60021847
K7GW	Trojan ( 00129bd51 )
Cybereason	malicious.7e8571
BitDefenderTheta	AI:Packer.FC0CC1B21D
Cyren	W32/Wabot.K.gen!Eldorado
Symantec	W32.Wabot
ESET-NOD32	a variant of Win32/Delf.NRF
Baidu	Win32.Backdoor.Wabot.a
TrendMicro-HouseCall	Backdoor.Win32.WABOT.SMD
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.Wabot.a
Alibaba	Malware:Win32/Dorpal.ali1000029
NANO-Antivirus	Trojan.Win32.Delf.eqwfrm
ViRobot	Trojan.Win32.Z.Wabot.96936.MR
MicroWorld-eScan	Trojan.GenericKD.60021847
APEX	Malicious
Rising	Backdoor.Wabot!8.31C (CLOUD)
Sophos	Mal/Generic-R + Troj/Luiha-M
Comodo	Backdoor.Win32.Wabot.A@4knk5y
DrWeb	Trojan.MulDrop6.64369
VIPRE	BehavesLike.Win32.Malware.ssc (mx-v)
TrendMicro	Backdoor.Win32.WABOT.SMD
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.nc
Emsisoft	Trojan.GenericKD.60021847 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Worm.Generic.gbw
Avira	TR/Dropper.Gen
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Generic.ASBOL.C66A
Microsoft	Backdoor:Win32/Wabot.A
GData	Trojan.GenericKD.60021847
AhnLab-V3	Backdoor/Win32.Wabot.R222262
VBA32	Backdoor.Wabot
ALYac	Trojan.GenericKD.60021847
TACHYON	Backdoor/W32.WaBot.96936.B
Malwarebytes	Backdoor.Wabot
Panda	Trj/Genetic.gen
Tencent	Trojan.Win32.Wabot.a
Yandex	Backdoor.Wabot!sCKKxb6+WV8
Ikarus	Backdoor.Wabot
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Delf.NRF!tr
AVG	Win32:Delf-VKB [Trj]
Avast	Win32:Delf-VKB [Trj]
CrowdStrike	win/malicious_confidence_100% (W)