Trojan.MalPack.FFS malicious file

The Trojan.MalPack.FFS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.MalPack.FFS virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Collects and encrypts information about the computer likely to send to C2 server
• Creates a hidden or system file
• Collects information to fingerprint the system

How to determine Trojan.MalPack.FFS?

File Info:
name: A95276D949AE7E70A527.mlw
path: /opt/CAPEv2/storage/binaries/f2d2a984cc7d2a832cfc4b4721b6175834e14328b6efe9ad0493595ee97eaaed
crc32: E9EABEB0
md5: a95276d949ae7e70a5273f187bd63394
sha1: d81255ee2f805669a8c01a37441d2828baece2cb
sha256: f2d2a984cc7d2a832cfc4b4721b6175834e14328b6efe9ad0493595ee97eaaed
sha512: 4cd28b27c46076c80ae61e89afe646cb8a70b35114172724efc4e911b6881a8765a0bb8e06eab2a550e05137961d65c1a2154a20b2c0ef2e7a26cda1a49315f4
ssdeep: 6144:5Vc4Y0oPrI80Jj/5aLUp7RLaJEVhBTfvfLkv2Q4VJdCfra6:nc4Y0q0jBaLU2ohhc2nVJds
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EC640169469D8633D03118F76EF1BA4EE9391A731F10805071806C16FE2FEB4667EACB
sha3_384: df7d60bba6d079a828f3a0ca8336742e00b44f64b44b10381b04f60ea617a64478afc86907eae9c3b360c29875999304
ep_bytes: 5458663d00f0907250b8605040008bc8
timestamp: 2007-04-18 11:23:51

Version Info:
0: [No Data]

Trojan.MalPack.FFS also known as:

How to remove Trojan.MalPack.FFS?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.