Categories: PUA

About “Mal/Generic-S + Huorong HRSword (PUA)” infection

The Mal/Generic-S + Huorong HRSword (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/Generic-S + Huorong HRSword (PUA) virus can do?

Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Uses Windows utilities for basic functionality
Creates a hidden or system file
Network activity detected but not expressed in API logs
Attempts to interact with an Alternate Data Stream (ADS)
Uses suspicious command line tools or Windows utilities

How to determine Mal/Generic-S + Huorong HRSword (PUA)?


File Info:
crc32: 8BE6A382md5: fe4be5a4b1108eda49e21c5461952e41name: FE4BE5A4B1108EDA49E21C5461952E41.mlwsha1: af03d0b612dc22d553d05aec719ba319462562c7sha256: f33fc45f0a62a395457fa55479b6e3631163daac38e20d1b1dd45160fbf36fd4sha512: fe2b1e8d42afbd1e86d18b0f7d3c626aa55e0a5c9672b64e8f6fc2a02d54808f751f51876b69cf7b522edbbf7604d5de7548dc01dd93e61f01e819d725aca42dssdeep: 49152:GZAD1ebpQ9/H6aVyF94JMkP4nctNh43Ovatw8nQwd:GAD1e+9SqG94JP4+n43Q8nQwdtype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
LegalCopyright: Beijing Huorong Network Technology Co., Ltd.InternalName: HRSwordFileVersion: 5.0.1.1CompanyName: Beijing Huorong Network Technology Co., Ltd.ProductName: Huorong Internet SecurityProductVersion: 5.0.0.1FileDescription: Huorong Sword GUI FrontendOriginalFilename: HRSword.exeTranslation: 0x0009 0x04b0

Mal/Generic-S + Huorong HRSword (PUA) also known as:

K7AntiVirus	Riskware ( 0040eff71 )
DrWeb	Trojan.MulDrop8.41187
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.33562554
Cylance	Unsafe
Zillya	Trojan.Inject.Win32.287297
Sangfor	Malware
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	Trojan:Win32/Tiggre.abd02cbf
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.4b1108
Cyren	W32/Trojan.MEQX-1937
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	FileRepMalware
ClamAV	Win.Malware.Agen-8002901-0
BitDefender	Trojan.GenericKD.33562554
NANO-Antivirus	Trojan.Win32.Drop.hpcggq
MicroWorld-eScan	Trojan.GenericKD.33562554
Ad-Aware	Trojan.GenericKD.33562554
Sophos	Mal/Generic-S + Huorong HRSword (PUA)
BitDefenderTheta	Gen:NN.ZexaCO.34760.@nNfa8e6q9dj
TrendMicro	TROJ_GEN.R06CC0PKM20
McAfee-GW-Edition	GenericRXGN-QK!0C70FB48BA34
FireEye	Generic.mg.fe4be5a4b1108eda
Emsisoft	Trojan.GenericKD.33562554 (B)
Webroot	W32.Malware.Gen
Antiy-AVL	Trojan/Win32.Fuerboos
Microsoft	Trojan:Win32/Occamy.CF3
Arcabit	Trojan.Generic.D2001FBA
AegisLab	Trojan.Win32.Generic.4!c
GData	Trojan.GenericKD.33562554
McAfee	Artemis!FE4BE5A4B110
MAX	malware (ai score=88)
VBA32	BScope.Trojan.Downloader
Malwarebytes	Trojan.Downloader
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R06CC0PKM20
Yandex	Trojan.Agent!EeDxoFgSVjE
Fortinet	W32/Graftor.858453!tr
AVG	FileRepMalware
Paloalto	generic.ml