Mal/Generic-R + Troj/Wonton-QM (file analysis)

The Mal/Generic-R + Troj/Wonton-QM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/Generic-R + Troj/Wonton-QM virus can do?

• Injection (inter-process)
• Injection (Process Hollowing)
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Reads data out of its own binary image
• A process created a hidden window
• Drops a binary and executes it
• Performs some HTTP requests
• The binary likely contains encrypted or compressed data.
• Looks up the external IP address
• Uses Windows utilities for basic functionality
• Executed a process and injected code into it, probably while unpacking
• Attempts to remove evidence of file being downloaded from the Internet
• Attempts to delete volume shadow copies
• Deletes its original binary from disk
• Network activity contains more than one unique useragent.
• Installs itself for autorun at Windows startup
• Exhibits possible ransomware file modification behavior
• Creates a copy of itself
• Connects to Tor Hidden Services through a Tor gateway
• Creates a known TeslaCrypt/AlphaCrypt ransomware decryption instruction / key file.
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

Related domains:

How to determine Mal/Generic-R + Troj/Wonton-QM?

File Info:
crc32: 98E9DABB
md5: a084c0018f5af677a44d223e25b66718
name: A084C0018F5AF677A44D223E25B66718.mlw
sha1: f51f0bdee133c014e2bf4eb5b5d6faf5f8f3a41a
sha256: 26d16f7ed5c2e799edb38ede54b7b4b13aa27e6fd1dd6b197a005f71991fcb4c
sha512: 8e7700c630646055a9a6d88f71ef0daf30e427c633555b78c401b235d06b86536adf58d4f826bba0b5e083971fdc622e4667af42d8a2ec5f147c01937d4577ce
ssdeep: 24576:rtivhqeFwufxuh5jD9TJArf/x72ISXou/l9Vc08hWNk6F7fvEIZDelPXH+vroYb:Biv8e6iuHVel/MWBvZX6
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2016 by FastStone Soft
InternalName: 
FileVersion: 8.4.0.0
CompanyName: FastStone Soft
LegalTrademarks: 
Comments: 
ProductName: FastStone Capture
ProductVersion: 8.4
FileDescription: FastStone Capture
OriginalFilename: 
Translation: 0x0019 0x04e3

Mal/Generic-R + Troj/Wonton-QM also known as:

How to remove Mal/Generic-R + Troj/Wonton-QM?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.