Trojan.GenericRI.S26298240 malicious file

The Trojan.GenericRI.S26298240 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.GenericRI.S26298240 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Hongkong)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Queries information on disks, possibly for anti-virtualization
• Attempts to restart the guest VM
• Uses IOCTL_SCSI_PASS_THROUGH control codes to manipulate drive/MBR which may be indicative of a bootkit
• Spoofs its process name and/or associated pathname to appear as a legitimate process
• Attempted to write directly to a physical drive

How to determine Trojan.GenericRI.S26298240?

File Info:
name: A73275FF1319C86327C6.mlw
path: /opt/CAPEv2/storage/binaries/8d4c962c7e8199ab0ff20c0741a39bbe00932cd5cbd5b83446128538d5666f95
crc32: CEAB9C4A
md5: a73275ff1319c86327c6e8f4f14337f6
sha1: 8a426fe6472c98d980bab1a7494a18f00157d991
sha256: 8d4c962c7e8199ab0ff20c0741a39bbe00932cd5cbd5b83446128538d5666f95
sha512: 9adf759a2edaf44e2fa79e1bcc99a4c317537abc4e27f6839f5c010d583860b63118d0fdb71e9a6c7a2083c9b2eedb439d178a7b8d9cc48dafe9feca8dca58d6
ssdeep: 12288:oSGB67hjdsDYd2WEgFCRI+pvWkIBm3XjtbH/9H2zUmz2nRSO:LMkdH8G+Nkyhz8QuwR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DBE4E110A650C035F5B722F85A76A77CBA3E3AF1576490CB12D52AEE1A746E0FC3131B
sha3_384: 8c3053a3afadbd434ef86aec99f58403786098157df817f85b1e51725ff2f0d5b42e17087f7a95b8bd00de3783dfff18
ep_bytes: 8bff558bece876d70000e8110000005d
timestamp: 2020-12-21 12:14:44

Version Info:
0: [No Data]

Trojan.GenericRI.S26298240 also known as:

How to remove Trojan.GenericRI.S26298240?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.