Should I remove “Trojan.Injector.BIC”?

The Trojan.Injector.BIC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Injector.BIC virus can do?

• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Removes Security and Maintenance icon from Start menu, Taskbar and notifications
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Exhibits behavior characteristic of Andromeda/Gamarue malware
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Created a process from a suspicious location
• Attempts to modify user notification settings

How to determine Trojan.Injector.BIC?

File Info:
name: EF947B2C2C36B76A0CEB.mlw
path: /opt/CAPEv2/storage/binaries/19982d6c46ccbe2da1516716e7c60cb39654574f5666327efc206f0853e3daab
crc32: 33BF9259
md5: ef947b2c2c36b76a0ceb87880654206c
sha1: 07238209854465197db64993adbbdb8bea84e6f9
sha256: 19982d6c46ccbe2da1516716e7c60cb39654574f5666327efc206f0853e3daab
sha512: c881e2f5acfee377ec7bae965832d516313d3dcc87abd390dbb5856b4b6c2947c89ab29a0e598b521c878ae96b4afe81e9f7d52747dce15835c1e172411c0dc0
ssdeep: 768:OVwu8YBn2f22222i222222222222222222222222257kd4YqGElGzGeCCeb2222w:OVwAF2f22222i222222222222222222B
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T122F22A8221C4D4D3D75C027248FB399AF9A15E6B818587E263F2FBCF2F7270268169D4
sha3_384: 06d721c521b4f492f4ea55a0ed466f25f51bd48920594b5879ff6623c6864fb93face8de8185e1dfe289f9f31669d1d2
ep_bytes: 558bec6aff6820254000685019400064
timestamp: 2015-03-26 15:33:26

Version Info:
0: [No Data]

Trojan.Injector.BIC also known as:

How to remove Trojan.Injector.BIC?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.