Malware

Mal/Generic-S + Mal/Qbot-B removal tips

Malware Removal

The Mal/Generic-S + Mal/Qbot-B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Mal/Generic-S + Mal/Qbot-B virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • At least one process apparently crashed during execution
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid

How to determine Mal/Generic-S + Mal/Qbot-B?



File Info:

name: 406278A33B01824F031B.mlw
path: /opt/CAPEv2/storage/binaries/e7f7aa8c9ea3faaefed7d677aab7169b378a86c47511f80b688ee480b0e2d8e4
crc32: A5C22410
md5: 406278a33b01824f031b20e9a3342296
sha1: 4cfa22625702cbda5d3183dcd3e5f9e35792a448
sha256: e7f7aa8c9ea3faaefed7d677aab7169b378a86c47511f80b688ee480b0e2d8e4
sha512: 86d7139bdb0ea1c1ef03bc564af586330a41c3ee024f5bd4d4847a2047d90e230242e72e222830714fd2cc961b068b844dcca3d4f36d8bc2fc1adae4af356935
ssdeep: 12288:+S6lbzFYKJaaAm8wkMZ6lAgJAZi1wy4xi/pcl5tgmrgNsM2MlUZARx76SpRVrztA:Klbziza8wk2ghkxkpclcmrgNqepRx9Ha
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17CF433EBBAC9CF4DFAA200FEEA5678154D66B9499B479BFF83111D08EC530487131E05
sha3_384: 750886045338d4ed9ff8eb210da163775e35a13d8267a45f88a4c351da9614a80df9318cf18b2ee957fc9c4e275acd72
ep_bytes: 60be003043008dbe00e0fcff5783cdff
timestamp: 2007-02-07 13:34:02


Version Info:

CompanyName: нПмаХчаавлвЙУцЧвДЧЯьща
FileDescription: ЫАцВЛГЖБишПОСоЦаЖнВмчвуц
FileVersion: 122.34.64.19
InternalName: СйЙЬеноХоШАФлмЬпфФИЮАакйЬеЛур
OriginalFilename: GPfu.exe
ProductName: кеаЗТЮшйЯаъБрТЮЫЩНШРмЕжЫНЮж
ProductVersion: 122.34.64.19
Translation: 0x04b0 0x0417

Mal/Generic-S + Mal/Qbot-B also known as:

BkavW32.AIDetect.malware2
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
FireEyeGeneric.mg.406278a33b01824f
ALYacGen:Heur.Krypt.29
CylanceUnsafe
VIPRETrojan.Win32.Nedsym.f (v)
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 0055dd191 )
AlibabaTrojanPSW:Win32/Obfuscator.a960d3f3
K7GWTrojan ( 0055dd191 )
Cybereasonmalicious.33b018
VirITPacked.Win32.Katusha.J
CyrenW32/Trojan.EBRM-3511
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.EHC
APEXMalicious
ClamAVWin.Trojan.Packed-530
KasperskyPacked.Win32.Krap.hm
BitDefenderGen:Heur.Krypt.29
NANO-AntivirusTrojan.Win32.Krap.cvqlid
MicroWorld-eScanGen:Heur.Krypt.29
AvastFileRepMalware
TencentMalware.Win32.Gencirc.10b87c9b
Ad-AwareGen:Heur.Krypt.29
SophosMal/Generic-S + Mal/Qbot-B
ComodoMalCrypt.Indus!@1qrzi1
DrWebTrojan.Packed.20343
ZillyaTrojan.Kryptik.Win32.93304
TrendMicroBKDR_QAKBOT.SMC
McAfee-GW-EditionBehavesLike.Win32.Generic.bc
EmsisoftGen:Heur.Krypt.29 (B)
SentinelOneStatic AI – Malicious PE
GDataGen:Heur.Krypt.29
JiangminPacked.Katusha.idy
WebrootW32.Malware.Gen
AviraTR/Dropper.Gen
MAXmalware (ai score=100)
Antiy-AVLTrojan[Packed]/Win32.Krap
ArcabitTrojan.Krypt.29
ZoneAlarmPacked.Win32.Krap.hm
MicrosoftPWS:Win32/Zbot.gen!rfn
McAfeeArtemis!406278A33B01
MalwarebytesMalware.Heuristic.1003
TrendMicro-HouseCallBKDR_QAKBOT.SMC
RisingDropper.Generic!8.35E (CLOUD)
YandexTrojan.GenAsa!hKBlQ+uF2kM
IkarusPacker.Win32.Krap
MaxSecureTrojan.Malware.1382627.susgen
FortinetW32/Generic.AC.2AA013!tr
BitDefenderThetaAI:Packer.4421437B1F
AVGFileRepMalware
PandaTrj/Krapack.gen
CrowdStrikewin/malicious_confidence_70% (D)

How to remove Mal/Generic-S + Mal/Qbot-B?

Mal/Generic-S + Mal/Qbot-B removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment