Tedy.55926 information

The Tedy.55926 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Tedy.55926 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• At least one process apparently crashed during execution
• Attempts to connect to a dead IP:Port (2 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Guard pages use detected – possible anti-debugging.
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• A named pipe was used for inter-process communication
• Starts servers listening on 127.0.0.1:0
• Reads data out of its own binary image
• Unconventionial language used in binary resources: Korean
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• A possible heap spray exploit has been detected
• Attempts to modify proxy settings
• Harvests cookies for information gathering

How to determine Tedy.55926?

File Info:
name: 383131053A4F1335AED1.mlw
path: /opt/CAPEv2/storage/binaries/cc2d19d9fcc325242f5229b18ac267b829fdc60e4adbfd6ac17848864599d8e3
crc32: E305FDA7
md5: 383131053a4f1335aed1e94901086f75
sha1: 65e94e0f8090b743b541e09682930e302db852b7
sha256: cc2d19d9fcc325242f5229b18ac267b829fdc60e4adbfd6ac17848864599d8e3
sha512: b6848281868871ff5c2d0f42cd7f7277979c2419752dfcc4d368bcf6c8888079ef0e58c59e1b5544b75aebf12882a7bea27585a1a52566bd399359b2ba049bf5
ssdeep: 49152:MSIjgEFEZYQXspybBJorbDp7oH2PEqLibV6DRf8+Rbj:MPjgESZAGJSfp0HgEqLibV6FfJRbj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BA95334025C66995E5920DB16B2FB8F11D0238339F8A79200C5FCEEC8CB59E6DFDA653
sha3_384: cbb051d77f30d483f0a3bda7525be6b280d9f857a2d5ecf5cc4d3137490a4aedda7088cb39cce21b68459ab3b8a5b9c9
ep_bytes: 60be00004b008dbe0010f5ff57eb0b90
timestamp: 2020-05-08 21:21:24

Version Info:
CompanyName: Zepetto Co.
FileDescription: PBLauncher
FileVersion: 1.1.0.0
InternalName: PBLauncher.exe
LegalCopyright: (c) Zepetto. All rights reserved.
OriginalFilename: PBLauncher.exe
ProductName: PBLauncher
ProductVersion: 1.1.0.0
Translation: 0x0412 0x03b5

Tedy.55926 also known as:

How to remove Tedy.55926?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.