Should I remove “Trojan.GenericRI.S26298265”?

The Trojan.GenericRI.S26298265 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.GenericRI.S26298265 virus can do?

• Attempts to connect to a dead IP:Port (2 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• Starts servers listening on 0.0.0.0:40500
• Drops a binary and executes it
• Authenticode signature is invalid
• Attempts to remove evidence of file being downloaded from the Internet
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Attempts to modify proxy settings
• Creates a copy of itself
• Attempts to modify or disable Security Center warnings

How to determine Trojan.GenericRI.S26298265?

File Info:
name: 0ED0FC5DCB9F32351980.mlw
path: /opt/CAPEv2/storage/binaries/73651dd8ea44ce23c0472b694100ef268102ed62b1be5ec54c6234637046ebca
crc32: 08697203
md5: 0ed0fc5dcb9f323519803fd6fa942f86
sha1: 008851e4a37b024dc831963e43104914896fe491
sha256: 73651dd8ea44ce23c0472b694100ef268102ed62b1be5ec54c6234637046ebca
sha512: fb7fbfe93145b3f3e1906b0a932d44cebbea09ea6f75f024d9df66293ba9c9c8a2cfc0447ba420fc20d59f453f893002b45054342a35ca66e0839b7dbca82d33
ssdeep: 1536:ma3Mz87CwTaegB6o8RLoXEE69JdogMau5FRF96:mhw+6ttoXh6i35FR6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DA733910F6D1C13AF0F784FFD2FB15AA692CAFB13345A4E71394648B5A215D1AA32463
sha3_384: d7b10cbb198511aa9e1fbf5bb26da25a5300c8b697f6f02410b9853fde9e7cc7bf03abbb7580661cc4b0c2b64db4e565
ep_bytes: 558bec81ec4c0c00006888130000ff15
timestamp: 2022-01-21 00:44:12

Version Info:
0: [No Data]

Trojan.GenericRI.S26298265 also known as:

How to remove Trojan.GenericRI.S26298265?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.