Should I remove “Mal/Mdrop-BK”?

The Mal/Mdrop-BK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/Mdrop-BK virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Harvests cookies for information gathering
• Anomalous binary characteristics

Related domains:

How to determine Mal/Mdrop-BK?

File Info:
name: 0FBCC4CCAAB9E9B95853.mlw
path: /opt/CAPEv2/storage/binaries/6198625838ec69d2c33477f3811d925e1db9b024fcd8bb9dae0877a529318b7a
crc32: DB4DF4C0
md5: 0fbcc4ccaab9e9b958533c7e8f3a5795
sha1: 8bf8513b5d357a677889fe3072c0669478274326
sha256: 6198625838ec69d2c33477f3811d925e1db9b024fcd8bb9dae0877a529318b7a
sha512: 52c1dde3176e141277d564c7b95f73d55f6db454559e4c4569e58f1cbd88e1545ce532b4ae47042bad60167543e9175bad6cf98c2c15890fe4319484e9e6df00
ssdeep: 12288:M4G8ghTaFb6k0qeaBWE1IH4jVpxHicrGvfDZV6KC1/sADu7zdKp2CLGQ:MueTC1eaBJ64jVpxCcraj6KhM0ccCLGQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T139051208A581C073C4B2053984E5CBB99A35387A1B6F94C3F79E2BF66D262D4D9353CE
sha3_384: 2082020efa98d71d894b3650ce7b39d7b133ee87e5ef1de3f48a3f287e156d33f1ec9a23293621ca32a5ca2f21a56a63
ep_bytes: e8dd5b0000e9a4feffff6a0c68c81342
timestamp: 2009-09-20 11:43:57

Version Info:
Translation: 0x0000 0x04b0
Comments: q群18573707,79101251
CompanyName: 687130@qq.com
FileDescription: 一球成名浏览器
FileVersion: 1.0.4418.34882
InternalName: 一球成名浏览器.exe
LegalCopyright: Copyright ©  2011
LegalTrademarks: 687130@qq.com
OriginalFilename: 一球成名浏览器.exe
ProductName: 一球成名浏览器
ProductVersion: 1.0.4418.34882
Assembly Version: 1.0.4418.34882

Mal/Mdrop-BK also known as:

How to remove Mal/Mdrop-BK?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.