Malware

About “Mal/Generic-R + Troj/Miner-AAZ” infection

Malware Removal

The Mal/Generic-R + Troj/Miner-AAZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Mal/Generic-R + Troj/Miner-AAZ virus can do?

  • Dynamic (imported) function loading detected
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid

How to determine Mal/Generic-R + Troj/Miner-AAZ?



File Info:

name: 6E2346387DA395CEE7ED.mlw
path: /opt/CAPEv2/storage/binaries/922f78cc907235fd75e80599e7cf712c632a480a912b9f61f3b8d51088df6877
crc32: 5D2B65F6
md5: 6e2346387da395cee7ed8e241360ab15
sha1: 753039b1cbeec9a34f65415c1ad4f7b8cf2d4f87
sha256: 922f78cc907235fd75e80599e7cf712c632a480a912b9f61f3b8d51088df6877
sha512: 956477de92c3068060077ad72b9098b657e2da2daa4c56d812a923227b0764a6d6fb39b8e24ed749646bd5f6860543ef19038c7ed9035f9361cb499a8757bb1f
ssdeep: 6144:whSt2d6FU0y1Bmw5dyUpFUBqN3LTtCqaeyC+L6brB44K5:wh82d62ZMwnyeFRXtCJ/CZhK
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T104440246F1E91F10C2B415FEB20BAB79A4E5C8376C69E200D3AE1B43C5BDF0137A6656
sha3_384: 9073e83b3ec6f969e8e71a45fe3723d7bafdd5e9815202c7375999517929aa43743d7668821fa9cf94d410a5c67153f6
ep_bytes: 53565755488d35e528fcff488dbe0070
timestamp: 2021-11-17 06:49:59


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Host Process for Windows Service
FileVersion: 2.0.0.0
InternalName: sqhost.exe
LegalCopyright: Copyright (C) 2016
OriginalFilename: sqhost.exe
ProductName: sqhost.exe
ProductVersion: 2.0.0.0
Translation: 0x0409 0x04b0

Mal/Generic-R + Troj/Miner-AAZ also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanGen:Heur.Variadic.Prometei.A
FireEyeGeneric.mg.6e2346387da395ce
McAfeeArtemis!6E2346387DA3
CylanceUnsafe
ZillyaTrojan.Agent.Win64.9951
CrowdStrikewin/malicious_confidence_90% (W)
AlibabaTrojan:Win64/Miner.e78fb17e
K7AntiVirusTrojan ( 005648511 )
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of Win64/Agent.XF
TrendMicro-HouseCallTROJ_GEN.R002C0RLA21
KasperskyTrojan.Win64.Agent.qwhxwc
BitDefenderGen:Heur.Variadic.Prometei.A
AvastWin64:CoinminerX-gen [Trj]
TencentMalware.Win32.Gencirc.10cf8b56
Ad-AwareGen:Heur.Variadic.Prometei.A
SophosMal/Generic-R + Troj/Miner-AAZ
TrendMicroTROJ_GEN.R002C0RLA21
McAfee-GW-EditionBehavesLike.Win64.Fake.dc
EmsisoftGen:Heur.Variadic.Prometei.A (B)
SentinelOneStatic AI – Suspicious PE
JiangminTrojan.Agent.dskp
AviraHEUR/AGEN.1140127
MAXmalware (ai score=83)
Antiy-AVLTrojan/Generic.ASMalwS.34D6151
GridinsoftRansom.Win64.Gen.sa
MicrosoftTrojan:Win32/Woreflint.A!cl
GDataGen:Heur.Variadic.Prometei.A
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.CoinMiner.R413841
ALYacGen:Heur.Variadic.Prometei.A
MalwarebytesTrojan.BitCoinMiner
APEXMalicious
YandexTrojan.Agent!FyoGzQxOs7M
IkarusWin32.Outbreak
MaxSecureTrojan.Malware.300983.susgen
FortinetW64/Agent.XF!tr
AVGWin64:CoinminerX-gen [Trj]
Cybereasonmalicious.87da39

How to remove Mal/Generic-R + Troj/Miner-AAZ?

Mal/Generic-R + Troj/Miner-AAZ removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment