Categories: Malware

ML/PE-A + Troj/Bayrob-BV (file analysis)

The ML/PE-A + Troj/Bayrob-BV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Troj/Bayrob-BV virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
Enumerates running processes
Expresses interest in specific running processes
Reads data out of its own binary image
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Likely virus infection of existing system binary
Creates a copy of itself
Created a service that was not started

How to determine ML/PE-A + Troj/Bayrob-BV?


File Info:
name: 1DB57C5BDDC62E140D0C.mlwpath: /opt/CAPEv2/storage/binaries/69bbda6afe0db98184322f38093c265f871654bc6f0eadf846a5fd513dd4b7bdcrc32: 1D6AE262md5: 1db57c5bddc62e140d0c1ba3fc35da32sha1: 60308e852c11c88a4f20bcff462336cf76aa5b31sha256: 69bbda6afe0db98184322f38093c265f871654bc6f0eadf846a5fd513dd4b7bdsha512: db855b0c3e485b0f595cf8aeb99f18e47dfd23a25e24122582f3488f9c013977973e34626d8236512ed3e8b9b186611706652b04cf1152322ce0dccac590bcfbssdeep: 6144:2wI7q7AVcXvjvLYPSqc9TFlsrDgEY25mGLGVZ3UvR1xMfB2:2beXv0cevgRVZbtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T18C449D44E450A3B1ED41C7F5E94ADAB6C9BE01717AB84D27C6CA2F0478B1244FB3B798sha3_384: c552db0944b7a7f113e59c581a1b1c0f46a8adebbb6891996469a6abcf484771599fe342b5f816e6ce78964d52920741ep_bytes: 83ec0cc70538d5450001000000e84e7ctimestamp: 2015-01-06 02:26:08
Version Info:
0: [No Data]

ML/PE-A + Troj/Bayrob-BV also known as:

Bkav	W32.BRBTTc.Worm
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.GZ.qGW@bSQHHQ
FireEye	Generic.mg.1db57c5bddc62e14
CAT-QuickHeal	TrojanSpy.Nivdort.WR8
ALYac	Gen:Trojan.Heur.GZ.qGW@bSQHHQ
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 004e2ee21 )
K7GW	Trojan ( 004e2ee21 )
Cybereason	malicious.bddc62
BitDefenderTheta	AI:Packer.DD5332371D
Cyren	W32/Nivdort.K.gen!Eldorado
Symantec	Trojan.Bayrob!g10
ESET-NOD32	a variant of Win32/Bayrob.CD
Baidu	Win32.Trojan.Bayrob.e
TrendMicro-HouseCall	TROJ_BAYROB.SMX
Kaspersky	HEUR:Trojan.Win32.Bayrob.gen
BitDefender	Gen:Trojan.Heur.GZ.qGW@bSQHHQ
NANO-Antivirus	Trojan.Win32.Dwn.ebuied
Avast	Win32:Trojan-gen
Rising	Malware.Heuristic!ET#98% (RDMK:cmRtazrUIxPn0wn7hpeE1EXrTcAW)
Ad-Aware	Gen:Trojan.Heur.GZ.qGW@bSQHHQ
Sophos	ML/PE-A + Troj/Bayrob-BV
DrWeb	Trojan.Bayrob.58
TrendMicro	TROJ_BAYROB.SMX
McAfee-GW-Edition	BehavesLike.Win32.Trojan.dh
SentinelOne	Static AI – Malicious PE
Emsisoft	Gen:Trojan.Heur.GZ.qGW@bSQHHQ (B)
APEX	Malicious
GData	Gen:Trojan.Heur.GZ.qGW@bSQHHQ
Jiangmin	Trojan.Bayrob.nuc
Avira	HEUR/AGEN.1118567
MAX	malware (ai score=85)
Antiy-AVL	Trojan/Generic.ASMalwS.181B479
Microsoft	Trojan:Win32/Woreflint.A!cl
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.R178732
Acronis	suspicious
McAfee	Trojan-FIIE!1DB57C5BDDC6
TACHYON	Trojan/W32.Bayrob.265728.B
VBA32	BScope.Trojan.Diple
Tencent	Trojan.Win32.BitCoinMiner.la
Yandex	Trojan.GenAsa!ybOLeOIGTA0
Ikarus	Trojan.Win32.Bayrob
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Bayrob.BR!tr
AVG	Win32:Trojan-gen
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (D)