Trojan-Dropper.Win32.Scrop (file analysis)

The Trojan-Dropper.Win32.Scrop is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Dropper.Win32.Scrop virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (4 unique times)
Creates RWX memory
Performs some HTTP requests
Unconventionial language used in binary resources: Spanish (Venezuela)
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time
Attempts to identify installed AV products by installation directory
Checks the CPU name from registry, possibly for anti-virtualization
Anomalous binary characteristics

Related domains:

iplogger.org

apps.identrust.com

gferhrolklm.top

How to determine Trojan-Dropper.Win32.Scrop?


File Info:
crc32: 944D5096
md5: c5f9ffd8890ca4722cd2f6ebdc39566f
name: upload_file
sha1: ddeaf76ff2426dc3a7202dc3e84ed4bcbfa97893
sha256: 1ba87aa4f285a9e9cf905da0bc041df4eed434e6bff38aa189387dae4ba90dc5
sha512: 9c0c3811139a8d35ef2debaea44bad4ab34055394d578ac7fc2646b0c2eaa786a3ddf0fa283a134f551ea254ec1ebdecd22940434e783ba10666299cce069694
ssdeep: 12288:5FD4xAMf7dxzBq7K5PFM7D9miAVpBK7gCcNrIoa5xNpa:5FDyN7dxU+9kDnsxCokxba
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
InternalName: wriheawtz.otu
FileVers: 1.2.58
Copyright: Copyrighd (C) 2020, gumke
TranslationUsi: 0x0431 0x0c55

Trojan-Dropper.Win32.Scrop also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.44274672
FireEye	Generic.mg.c5f9ffd8890ca472
Malwarebytes	Trojan.MalPack.GS
Sangfor	Malware
K7GW	Trojan ( 0057205d1 )
Cybereason	malicious.ff2426
Invincea	Generic ML PUA (PUA)
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	HEUR:Trojan-Dropper.Win32.Scrop.gen
BitDefender	Trojan.GenericKD.44274672
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKD.44274672
Emsisoft	Trojan.GenericKD.44274672 (B)
McAfee-GW-Edition	BehavesLike.Win32.MultiPlug.bh
SentinelOne	DFI – Malicious PE
GData	Win32.Trojan.AutoHotkey.V1UQN5
MAX	malware (ai score=83)
Arcabit	Trojan.Generic.D2A393F0
ZoneAlarm	HEUR:Trojan-Dropper.Win32.Scrop.gen
Microsoft	Trojan:Win32/Wacatac.D1!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	Packed-GCZ!C5F9FFD8890C
VBA32	BScope.Trojan.Wacatac
ESET-NOD32	a variant of Win32/Kryptik.HHCY
Rising	Malware.Obscure/Heur!1.9E03 (CLASSIC)
Ikarus	Trojan.Win32.Glupteba
Fortinet	W32/Kryptik.HHCY!tr
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	HEUR/QVM10.1.F3CB.Malware.Gen

How to remove Trojan-Dropper.Win32.Scrop?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan-Dropper.Win32.Scrop (file analysis)