Trojan.GenericIH.S24070444 malicious file

The Trojan.GenericIH.S24070444 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.GenericIH.S24070444 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Performs HTTP requests potentially not found in PCAP.
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Enumerates running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Reads data out of its own binary image
• Manipulates data from or to the Recycle Bin
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Installs itself for autorun at Windows startup
• Anomalous binary characteristics

How to determine Trojan.GenericIH.S24070444?

File Info:
name: 438A754A4291D6A4C068.mlw
path: /opt/CAPEv2/storage/binaries/fc53d0b95f08017008b8c1e13ee7993ebeca1173b6aeee494d8834a133a5cc21
crc32: EB27D25D
md5: 438a754a4291d6a4c068695ee3ede38a
sha1: f6e23951c507d18ece0a91f7a7a1c8bc1cfa90cf
sha256: fc53d0b95f08017008b8c1e13ee7993ebeca1173b6aeee494d8834a133a5cc21
sha512: cf6847162405f8dabc66a3b5641ab27e4250ba5f85625d86cb1209e3720bf0a6df476e1fcddfc25ab2b5da203325dda1bfeb56a38d08fbf054c5aeafeff1cf39
ssdeep: 3072:u0v4Yb2eruGgAaeXWhTj+feBAyixPfGSqxwHr5EIg:Jvrb22uGLbWhTjYeB+PfGCg
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1ABD3E14197AC402BE8671E7056F4D623AD3CBA621F388BCF6051969A1CFB7D0ED3471A
sha3_384: af039b388c2ce9776892d970b71bee3fc14ddc4aeb85bcb1867fe757330c3dcd5d82ce94e61de1fa8f1cb759c7b9b202
ep_bytes: 60be00a042008dbe0070fdffc78708d7
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Trojan.GenericIH.S24070444 also known as:

How to remove Trojan.GenericIH.S24070444?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.