Rootkit.39824 (B) (file analysis)

The Rootkit.39824 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Rootkit.39824 (B) virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Rootkit.39824 (B)?

File Info:
name: 530C01FF82B33F9E7304.mlw
path: /opt/CAPEv2/storage/binaries/5db866846f347d2eb988ada7bf6a93cbf9c114f8669ed4249e8cc80db87205cc
crc32: AD8AF03D
md5: 530c01ff82b33f9e73042dcdb568ff95
sha1: 28cf15da1f298cee7368eeaf6c2a5a105e7f9286
sha256: 5db866846f347d2eb988ada7bf6a93cbf9c114f8669ed4249e8cc80db87205cc
sha512: 36060a593905a6e6e18ec4c74815f0f92f36aa263741afd9846fe5c00bece261d05c7f65719e0f9327a40427b3b8a3db6b4d349ae0fa8e4df4a90a22485a04ab
ssdeep: 3072:Tx+DB7qqppKTKKTJgn4CbjpxUy+iFkFwO8/0HRq:w1HpKNJy4SjpxUWaFwO8/0xq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T140C3E04370FC7F06C52A2DB673068E71D81D5177A43AB4A493BED251BDEAEA041260BC
sha3_384: da17f245ca4aedb0ca2e0fc224dcbd7accb1cbcd78841c45008980a51db98e3bc92a5e632a8722ab83b58aa680318744
ep_bytes: 60be15b032018dbeeb5f0dff5783cdff
timestamp: 2006-05-17 20:04:42

Version Info:
0: [No Data]

Rootkit.39824 (B) also known as:

How to remove Rootkit.39824 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.