Trojan

Trojan.Generic.3802389 (file analysis)

Malware Removal

The Trojan.Generic.3802389 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan.Generic.3802389 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Drops a binary and executes it
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Attempts to modify browser security settings
  • Operates on local firewall’s policies and settings
  • Deletes executed files from disk
  • Harvests cookies for information gathering

How to determine Trojan.Generic.3802389?


File Info:

name: 64251814301AD5A232E9.mlw
path: /opt/CAPEv2/storage/binaries/1f9fb2b4d1b0689b9b4de463ecc71c0f6db643ccf295f5c5407a418bd689933d
crc32: 26D50680
md5: 64251814301ad5a232e9ade878efef2b
sha1: a71f5397a92b33c32a34181ef55d0d88f41786cb
sha256: 1f9fb2b4d1b0689b9b4de463ecc71c0f6db643ccf295f5c5407a418bd689933d
sha512: 5486dea6b64fd576aa2424c49ae444901b4a12c491ae2c908e7d1c575640afee120a017a49f5d92cc88cdcb5d82a78b2720c7ebc777a82251d34ed2348c0c086
ssdeep: 3072:FULk6JyRosafLcXPGPZLG06NeTH9jbiJ10TwB5AWf+MGT/:sk6kgzymLGjNe79j20wBKi
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EAE38BA1DF0C7548C80649338A2BBD886A50E9914B536F1F2152F5EDBC792BFCE44BE1
sha3_384: e5d26e147949d768439611b0c90e0e06719940066efb3398dc9b3c81e08f04d683e947dd9eb917ef11fec82bcf3b44e4
ep_bytes: 60be000041008dbe0010ffff5783cdff
timestamp: 2010-04-27 06:34:54

Version Info:

Translation: 0x0409 0x04b0
CompanyName: -
ProductName: Setup
FileVersion: 1.00
ProductVersion: 1.00
InternalName: zzxx
OriginalFilename: zzxx.exe

Trojan.Generic.3802389 also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.Swisyn.mCMf
tehtrisGeneric.Malware
DrWebTrojan.MulDrop1.16695
MicroWorld-eScanTrojan.Generic.3802389
FireEyeGeneric.mg.64251814301ad5a2
CAT-QuickHealTrojan.Sisproc.A4
ALYacTrojan.Generic.3802389
CylanceUnsafe
VIPRETrojan.Generic.3802389
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0026e1391 )
AlibabaTrojan:Win32/Starter.ali2000005
K7GWTrojan ( 0026e1391 )
Cybereasonmalicious.4301ad
BitDefenderThetaAI:Packer.93638A9820
VirITTrojan.Win32.Swisyn.AEDM
CyrenW32/Trojan.ZWBJ-8891
SymantecML.Attribute.HighConfidence
Elasticmalicious (moderate confidence)
ESET-NOD32Win32/TrojanClicker.VB.NIM
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Trojan.Swysyn-1
KasperskyTrojan.Win32.Swisyn.bhfe
BitDefenderTrojan.Generic.3802389
NANO-AntivirusTrojan.Win32.Swisyn.bhlwx
SUPERAntiSpywareTrojan.Agent/Gen-Frauder
AvastWin32:Malware-gen
TencentWin32.Trojan.Swisyn.Anhl
Ad-AwareTrojan.Generic.3802389
EmsisoftTrojan.Generic.3802389 (B)
ComodoMalware@#x651hmqqcoie
ZillyaTrojan.VB.Win32.360189
TrendMicroTSPY_SWISYN_CC162852.RDXN
McAfee-GW-EditionBehavesLike.Win32.Dropper.cc
Trapminemalicious.moderate.ml.score
SophosMal/Agent-ZJ
SentinelOneStatic AI – Malicious PE
GDataTrojan.Generic.3802389
JiangminTrojan/Swisyn.hdf
WebrootW32.Trojan.Swisyn.Gen
GoogleDetected
AviraTR/Dropper.Gen
MAXmalware (ai score=100)
Antiy-AVLTrojan/Generic.ASMalwS.F6
ViRobotTrojan.Win32.Swisyn.139776
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 100)
AhnLab-V3Spyware/Win32.VB.R273
Acronissuspicious
McAfeeArtemis!64251814301A
VBA32Trojan.VBRA.013687
MalwarebytesMalware.Heuristic.1003
TrendMicro-HouseCallTSPY_SWISYN_CC162852.RDXN
RisingTrojan.Generic!8.C3 (CLOUD)
YandexTrojan.Swisyn!q9VEN6cAzL0
IkarusTrojan.Crypt
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Swisyn.AAAB!tr
AVGWin32:Malware-gen
PandaW32/Koobface.LH.worm
CrowdStrikewin/malicious_confidence_90% (W)

How to remove Trojan.Generic.3802389?

Trojan.Generic.3802389 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment