Categories: Rootkit

Rootkit.46751 removal guide

The Rootkit.46751 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Rootkit.46751 virus can do?

Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
Yara rule detections observed from a process memory dump/dropped files/CAPE
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Deletes executed files from disk
Anomalous binary characteristics

How to determine Rootkit.46751?


File Info:
name: 58F7EEE8C26C7DC3FED4.mlwpath: /opt/CAPEv2/storage/binaries/881696666c5854c676683299e2774fd61352560e140ce4ec3fb259ea857f6c5fcrc32: 89620216md5: 58f7eee8c26c7dc3fed4f9ed370350e0sha1: c5c40d627eff5cb89b321555af7c0bbcce632b25sha256: 881696666c5854c676683299e2774fd61352560e140ce4ec3fb259ea857f6c5fsha512: dc6c202c76fcdec9f1e100109ef6706faddbad4802e1bad3e8794e7d6e0f90285e334eae0017d62d0514d75aae1fe34277e791b4b04293fc2cdb9ceca085732assdeep: 49152:baLKQDAfdcqqYjU+RgybySyq01QKORVoJvIojSWd6MVE7rM6IvxJ11HZIfKdV3d2:ba3Ufdcq3bRgEyU01oRVnojnd6MV2Abstype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T125E5331239CED427E1A33B715CFB0843C73BBC62785AC71E6205548CA9163A5DA7A36Fsha3_384: 1709ad93c1560d7fa2591fa3f4617bb9122c756c1839e4b5ab94c9050c38b45cc1b75624217c67a84fd34656b80ab3c2ep_bytes: 558bec83ec4456ff155c1100018bf08atimestamp: 2003-03-25 07:08:18
Version Info:
CompanyName: Microsoft Corporation: PSS Security TeamFileDescription: W.O.L.F - Windows Online Forensics ToolFileVersion: 1.3.8.2InternalName: WOLF_1.3.8.2.exeLegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: WOLF_1.3.8.2.exeProductName: W.O.L.F - Windows Online Forensics Tool - PSS SecurityProductVersion: v1.3.8Translation: 0x0409 0x04b0

Rootkit.46751 also known as:

Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
McAfee	Artemis!58F7EEE8C26C
Cylance	Unsafe
VIPRE	Rootkit.46751
Sangfor	Trojan.Win32.Heuristic.rg
Alibaba	Rootkit:Win32/Generic.c9c5fdfe
Cybereason	malicious.8c26c7
Cyren	W32/SYStroj.N.gen!Eldorado
Symantec	Hacktool.Rootkit
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Rootkit-8135
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Rootkit.46751
NANO-Antivirus	Trojan.Win32.SYStroj.cxdhvc
Avast	Win32:Trojan-gen
Rising	Trojan.Win32.Generic.15290BDF (C64:YzY0Ok4Cf4rQ5V/x)
DrWeb	Program.FPort.20
McAfee-GW-Edition	Artemis
FireEye	Rootkit.46751
Emsisoft	Rootkit.46751 (B)
Ikarus	Trojan.Rootkit
GData	Rootkit.46751 (2x)
Avira	TR/Rootkit.Gen
Arcabit	Rootkit.DB69F [many]
Microsoft	Trojan:Win32/Wacatac.B!ml
ALYac	Rootkit.46751
MAX	malware (ai score=89)
Yandex	Trojan.GenAsa!VCZLWRn4fgs
Fortinet	Dx.BBW4!tr
AVG	Win32:Trojan-gen