Categories: Trojan

Trojan-Dropper.Win32.Phpw.qq removal guide

The Trojan-Dropper.Win32.Phpw.qq is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Dropper.Win32.Phpw.qq virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
Yara rule detections observed from a process memory dump/dropped files/CAPE
Unconventionial language used in binary resources: Korean
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Trojan-Dropper.Win32.Phpw.qq?


File Info:
name: 6291897EC0743E62D9AE.mlwpath: /opt/CAPEv2/storage/binaries/b8036de6e3405263ec290ebb6e2700f59a50480ad9dcbe9d9be921284dbd93cdcrc32: F6ADF41Amd5: 6291897ec0743e62d9ae12571c5f7480sha1: b74359505f8344080a8fd74e7726c030e4beead7sha256: b8036de6e3405263ec290ebb6e2700f59a50480ad9dcbe9d9be921284dbd93cdsha512: d11faec85fab0c071d7a26da3f580fedd2d74a92d78079e699a25ec31d3c4af5c503835c17e43ccdfdc5be78b46e58e593dc7e01f8a2e62b5a59b7c57bd89a6bssdeep: 49152:4TwrpjFGmJy95RlflFOA2nkJIibM/c1WfSRwqqshZOYSPn0QbhkY:4TypjFGmJy95RlfD2ncR4/c8fSn1V+0ytype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T107C522117AC0C0B7E96B053848A5A7BAAB7EFA310B609AD763440B2E1F713D1DE35357sha3_384: 32ce56d7d15817d43d217309177571aae1a1f7cbda0ff4bd8b06776ce8efdd3bd1d960974bf21aac6e65951805e3c8c5ep_bytes: e8b0050000e97afeffff558bec6a00fftimestamp: 2021-12-03 06:14:35
Version Info:
0: [No Data]

Trojan-Dropper.Win32.Phpw.qq also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Phpw.b!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.RP.FwW@bi0VVciO
FireEye	Generic.mg.6291897ec0743e62
ALYac	Gen:Trojan.Heur.RP.FwW@bi0VVciO
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Alibaba	TrojanDropper:Win32/DLOADER.90be261f
K7GW	Backdoor ( 00544de51 )
K7AntiVirus	Backdoor ( 00544de51 )
Cyren	W32/Trojan.LJIU-8614
ESET-NOD32	a variant of Win32/Rbot.BKT
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Dropper.Win32.Phpw.qq
BitDefender	Gen:Trojan.Heur.RP.FwW@bi0VVciO
NANO-Antivirus	Trojan.Win32.FKM.fetkza
Avast	Win32:Trojan-gen
Rising	Trojan.Generic@ML.94 (RDML:GcgCdWwNrBZPHfA4mPt4xA)
Ad-Aware	Gen:Trojan.Heur.RP.FwW@bi0VVciO
DrWeb	WIN.WORM.Virus
TrendMicro	TROJ_GEN.R002C0PL621
McAfee-GW-Edition	BehavesLike.Win32.Rootkit.vc
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Gen:Trojan.Heur.RP.FwW@bi0VVciO
Jiangmin	TrojanDropper.Phpw.jv
Avira	TR/Agent.qmxcw
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	Trojan.Heur.RP.E513D6
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
AhnLab-V3	Trojan/Win.RK.C4678090
MAX	malware (ai score=87)
VBA32	TrojanDropper.Phpw
Malwarebytes	Trojan.Dropper
Tencent	Malware.Win32.Gencirc.11da3880
Yandex	Trojan.Agent!/BiT9vW9vU4
Ikarus	Trojan.Win32.Agent
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Rbot.BKT!tr
BitDefenderTheta	AI:Packer.EE48D6711F
AVG	Win32:Trojan-gen
Panda	Trj/CI.A
MaxSecure	Trojan.Malware.300983.susgen