Trojan.MCazm.Gen.1 information

The Trojan.MCazm.Gen.1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.MCazm.Gen.1 virus can do?

• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• Uses Windows utilities to enumerate running processes
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• The sample wrote data to the system hosts file.
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Trojan.MCazm.Gen.1?

File Info:
name: BE88D2D5E00DFDDAB8B9.mlw
path: /opt/CAPEv2/storage/binaries/048e8dab716c8f8937946c3a07cb3c0c4ce31db74893e6a31c5fcadb082bed60
crc32: B7651C5B
md5: be88d2d5e00dfddab8b99b01e1e6c19a
sha1: 0a8b985b18f3f0b3cfa2c0c251bc356f8e3399c6
sha256: 048e8dab716c8f8937946c3a07cb3c0c4ce31db74893e6a31c5fcadb082bed60
sha512: 47d16ccfb756f00a7dfaaae66d23dfec834d1afbe27a10ff6d58a00804f689e16a996da40aabc4989256129e10cd43f53845772f0efa071ce5026b6941ce2770
ssdeep: 12288:rk5L2FqPuLuuc36xpJRaj30vv4LjSuyhBfOEBgQUYKt2EGvK:r2yQPx3uRaS4LhKfJBgzYBK
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T102C401417780A8F5DAB5C672DF1EE36242B3F7A957411F87A2CA1E052ED31B1230B5CA
sha3_384: 563685272fdb082d0bd461628be882d4940b40cd4850896044d3604ab16f57d91c485fb6d0b34788cf4519b1128ddf55
ep_bytes: 558bec6aff68504c410068801f410064
timestamp: 2010-06-27 07:06:38

Version Info:
CompanyName: Oleg N. Scherbakov
FileDescription: 7z Setup SFX (x86)
FileVersion: 1.4.0.1795
InternalName: 7ZSfxMod
LegalCopyright: Copyright © 2005-2010 Oleg N. Scherbakov
OriginalFilename: 7ZSfxMod_x86.exe
PrivateBuild: June 27, 2010
ProductName: 7-Zip SFX
ProductVersion: 1.4.0.1795
Translation: 0x0000 0x04b0

Trojan.MCazm.Gen.1 also known as:

How to remove Trojan.MCazm.Gen.1?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.