About “Trojan.Generic.1749648” infection

The Trojan.Generic.1749648 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Generic.1749648 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• Manipulates data from or to the Recycle Bin
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Attempts to modify desktop wallpaper
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Likely virus infection of existing system binary
• Anomalous binary characteristics

How to determine Trojan.Generic.1749648?

File Info:
name: 62BC760AFDF52A8BA492.mlw
path: /opt/CAPEv2/storage/binaries/89b3a203fafc1319b6dd04dd27e5071bfe71e2150f2b02eb208f522e990d7197
crc32: 0D31D856
md5: 62bc760afdf52a8ba4925fbc18f576dc
sha1: 2c2b0505537226f5dc9769f11e5009f5cc45d6b8
sha256: 89b3a203fafc1319b6dd04dd27e5071bfe71e2150f2b02eb208f522e990d7197
sha512: a70056fe738b5d8663c962386022e51eeb686674c1f24c4cafed5dd3658106c16d697a021b15118626b873281df9c223383dfb7a732b574802dc80d82e5591b8
ssdeep: 1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmit3VtE/KfSFUf:qKtfDwsjPThTYszDH2fNVtE/yS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E5739F57FE9388B2E02505B86D14C6C6F6BA76303E1A456F76ED8E0CDE563C2111C2B7
sha3_384: d1378838e9c36f2e11b73441a4b34d039922854d9038f5ca474493bda15dd22268f5c92b191c8452d2942dc61b74fe2a
ep_bytes: 558bec83c4e8535633c08945e88945ec
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Trojan.Generic.1749648 also known as:

How to remove Trojan.Generic.1749648?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.