What is "NSIS:BotX-gen [Trj]"?

The NSIS:BotX-gen [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What NSIS:BotX-gen [Trj] virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
Attempts to connect to a dead IP:Port (6 unique times)
Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Reads data out of its own binary image
Drops a binary and executes it
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Queries information on disks, possibly for anti-virtualization
Network activity contains more than one unique useragent.
Creates a hidden or system file
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

ref.tbfull.com

zjml.f3322.org

st.p.360.cn

tr.p.360.cn

agt.p.360.cn

s.360.cn

pinst.360.cn

repository.certum.pl

subca.ocsp-certum.com

wotrus-ovca.ocsp-certum.com

How to determine NSIS:BotX-gen [Trj]?


File Info:
crc32: 3A71F952
md5: 42b974b7196f2b9e9c9acce04b896957
name: 42B974B7196F2B9E9C9ACCE04B896957.mlw
sha1: b7d4ffe598732efc13c47c67967a1211c2a9fe0d
sha256: b8cc766cb7774bfb5e4cf8d8eeca0cb69659b99039485c7c3180b45a6a86eadd
sha512: 86a624de5eb5ca671c3169416a48db24374f57f8bf7cc4d9bd3611cf031f86c25c7d8e97c43d9f04173484944e3a793646f6e66d4f94da61f1743f3bc582222f
ssdeep: 49152:CdVxnOdktke8Sh0J1ZI8Th+xGkZSN5E/rsjkctRQq6ONgSMCqYa34hKnfJqLIDKf:CTxOGtkUh0Nfh+gN5E/UkWChqXMHVdyF
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:
0: [No Data]

NSIS:BotX-gen [Trj] also known as:

K7AntiVirus	Trojan ( 0055d4871 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Rootkit.22030
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.ZRI.S12023332
ALYac	DeepScan:Generic.Keylogger.2.D64E2F5B
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (W)
K7GW	Trojan ( 0055d4871 )
Cybereason	malicious.7196f2
Cyren	W32/Farfli.BI.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	multiple detections
APEX	Malicious
Avast	NSIS:BotX-gen [Trj]
ClamAV	Win.Trojan.Farfli-7639977-0
Kaspersky	HEUR:Backdoor.Win32.Farfli.vho
BitDefender	DeepScan:Generic.Keylogger.2.D64E2F5B
NANO-Antivirus	Trojan.Win32.Farfli.henrej
MicroWorld-eScan	DeepScan:Generic.Keylogger.2.D64E2F5B
Sophos	Generic ML PUA (PUA)
BitDefenderTheta	AI:Packer.CEA186301F
TrendMicro	TROJ_GEN.R067C0DJT21
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.vc
FireEye	Generic.mg.42b974b7196f2b9e
Emsisoft	DeepScan:Generic.Keylogger.2.D64E2F5B (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor.Farfli.dmf
Avira	TR/Crypt.XPACK.Gen
eGambit	Unsafe.AI_Score_84%
Antiy-AVL	Trojan/Generic.ASMalwS.301D109
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Arcabit	DeepScan:Generic.Keylogger.2.D64E2F5B
GData	DeepScan:Generic.Keylogger.2.D64E2F5B
McAfee	Artemis!42B974B7196F
MAX	malware (ai score=86)
VBA32	Trojan.Rootkit
Malwarebytes	Backdoor.Farfli
TrendMicro-HouseCall	TROJ_GEN.R067C0DJT21
Rising	Trojan.Generic@ML.100 (RDML:/xmDP0of8kRuJ+DCi9JU4g)
Yandex	Trojan.Farfli!t7SwUQpNP0w
Ikarus	Backdoor.Win32.Shiz
Fortinet	W32/GenKryptik.DJUZ!tr
AVG	NSIS:BotX-gen [Trj]

How to remove NSIS:BotX-gen [Trj]?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “NSIS:BotX-gen [Trj]”?