Strictor.190085 (B) malicious file

The Strictor.190085 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Strictor.190085 (B) virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Spanish (Modern)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Tries to suspend Cuckoo threads to prevent logging of malicious activity
• Sniffs keystrokes
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Attempts to bypass application whitelisting by executing .NET utility in a suspended state, potentially for injection
• CAPE detected the njRat malware family
• Attempts to modify proxy settings
• Harvests cookies for information gathering
• Creates known Njrat/Bladabindi RAT registry keys
• Anomalous binary characteristics

How to determine Strictor.190085 (B)?

File Info:
name: 96DE932159C5A54E55F6.mlw
path: /opt/CAPEv2/storage/binaries/7588a99a568bfb157ffddbf0300a9a441f83cd33475040fb760bd98aa0038f53
crc32: 4FE6A763
md5: 96de932159c5a54e55f64d564cbf9d24
sha1: a2061f0e2e9169287ced28a58944dc129acef1a7
sha256: 7588a99a568bfb157ffddbf0300a9a441f83cd33475040fb760bd98aa0038f53
sha512: 9c7e5fd8acf5a3f62634668ad309de420898ecc15b58a03dbdedba5e33e3b3171726826c1ee33e45185561a6c02af4ace8dad74018505af267016b6091eda205
ssdeep: 196608:CCK9bnwtDkjYNhihVgVGKmtzDFYBtaFC7AOXjSvaPOvoPKUq/:Z8wtDkcNhuVV/tveSQGvo/q
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FF6612166750E022EEA5507FB71873534ABDAE6C81A7851F610C7DE8F9313A10BEE723
sha3_384: 37d826b6d16eee7b12672c77c18690bd158d6a89306af298e8e14596d1e5473de2b79ee6c6e8aea27c527a898212f693
ep_bytes: e8c8d00000e97ffeffffcccccccccccc
timestamp: 2019-04-28 10:55:10

Version Info:
FileDescription: IPTV_Checking
OriginalFilename: 
CompanyName: ZugZang
FileVersion: ...
LegalCopyright: ZugZang
ProductName: IPTV_Checking
ProductVersion: ...
Translation: 0x0409 0x04b0

Strictor.190085 (B) also known as:

How to remove Strictor.190085 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.